CVE-2026-122302

Kyverno before 1.19.2 contains a privilege escalation vulnerability that allows namespace admins to create resources beyond their RBAC because generate-rule admission checks verify the controller's permissions, not the author's. Attackers can create a namespaced Policy with generate rules targeti...

CVE-2026-122159

A weakness has been identified in Edge0-AI Audio8TTS up to 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6. This affects the function ArkTtsRuntime.init of the file onnxruntime01bint8/arkttsruntime/runtime.py of the component Model Path Resolution. Executing a manipulation of the argument slowdecodemode...

CVE-2026-122158

A security flaw has been discovered in InvoiceShelf up to 2.4.3/3.0.0-alpha.3. Affected by this issue is the function MemberService::create of the file app/Domains/Accounts/Application/MemberService.php. Performing a manipulation of the argument companies.id/companies.role results in improper...

CVE-2026-122157

A vulnerability was identified in Purocean Yank Note 3.93.0. Affected by this vulnerability is the function checkPermission of the file src/main/server/index.ts of the component Terminal Handler. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit is...

CVE-2026-122154

A vulnerability was found in purocean Yank Note 3.93.0. This impacts the function config.getAll of the file src/main/server/index.ts of the component Settings Endpoint. The manipulation results in information disclosure. The attack may be launched remotely. The exploit has been made public and...

CVE-2026-122151

A security vulnerability has been detected in Presenton up to 0.9.11-beta. Impacted is the function JSON.parse of the file /api/user-config of the component User Configuration Handler. Such manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit...

CVE-2026-122146

A weakness has been identified in 101arrowz fflate up to 0.8.3. This issue affects the function unzipSync of the file esm/index.mjs. This manipulation causes memory corruption. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for...

CVE-2026-109849

Incorrect privilege assignment issue exists in Hinemos. If this vulnerability is exploited, an attacker who can access the password change API with specific permissions that can be assigned to non-administrative users may change the password of an administrative user...

CVE-2026-122144

A security flaw has been discovered in nliautaud pico-content-editor up to 02d5ad6c820c5050c542ab9505819b5e0a0ba1af. This vulnerability affects unknown code. The manipulation results in cross-site request forgery. The attack may be performed from remote. The exploit has been released to the publi...

CVE-2026-122052

A vulnerability has been found in laspy up to 2.7.0. Affected by this issue is some unknown functionality of the file laspy/lasreader.py of the component LAS File Handler. The manipulation leads to uncontrolled memory allocation. Remote exploitation of the attack is possible...

WS-2026-0184

inflateGetDictionary in zlib inflate.c 1.2.7.1 through 1.3.2 can write up to 8 MB past the caller's 32 KB dictionary buffer. With windowBits 0, inflate takes the window size from the zlib header and stores an invalid size of up to 2^23 before rejecting it, and inflateReset/inflateSync keep it...

WS-2026-0179

OpenSSH sshd password authentication bypass on Linux systems that use musl libc with PAM disabled e.g. Alpine Linux, OpenWrt, Buildroot/Yocto musl builds. Since OpenSSH 7.3p1, when the target account's password field is '', sysauthpasswd passes a NULL salt and xcrypt borrows the salt of another...

WS-2026-0182

The zipRemoveExtraInfoBlock function in the minizip contrib library shipped with zlib contrib/minizip/zip.c 1.2.3.5 through 1.3.2 reads each extra-field block size as a signed 16-bit value and never checks it against the buffer length, so a crafted ZIP extra field for example from an untrusted...

WS-2026-0183

In zlib inflate.c 1.2.3.5 through 1.3.2, calling inflateSync with windowBits 0 before a zlib/gzip header has been read leaves the window size at zero, so inflate allocates a one-byte window. If the stream is then reused with inflateReset2 and a crafted header sets a real window size, updatewindow...

CVE-2026-122299

Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in parsecommit resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git's resolution behavior, while Poetry 2.5.1 ships this version and uses dulwich by default fo...

CVE-2026-102337

Webmin is a web-based system administration tool for Unix-like servers. Prior to 2.652, untrusted users with access to the File Manager or Upload and Download modules can direct Webmin's server-side URL download functionality to non-public network addresses because download destinations are not...

CVE-2026-77372

VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.30, the Unix, macOS, and FreeBSD serialization paths in src/Platform/Serializer.cpp and src/Volume/VolumePassword.cpp accept untrusted length and count values when deserializing data that can cross from the...

CVE-2026-97702

Open edX Platform enables the authoring and delivery of online learning at any scale. From the Ulmo release until release/ulmo.4 and release/verawood.1, the GET /api/support/v1/managecourseteam/ endpoint in CourseTeamManageAPIView requires only IsAuthenticated and omits the global support-role...

CVE-2026-62365

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. DecodeWinevt in src/analysisd/decoders/winevtchannel.c accumulates unnamed Windows EventChannel Data element contents into the fixed 65,535-byte joindata heap buffer but passes t...

CVE-2026-122080

The htmLawed module enables use of the "htmLawed" https://bioinformatics.org/phplabware/internalutilities/htmLawed/index.php PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input. The module's filtering of malicious HTML can be bypassed by using a malformed...

CVE-2026-122079

The htmLawed module enables use of the "htmLawed" htmLawed website: https://bioinformatics.org/phplabware/internalutilities/htmLawed/index.php PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input. The htmLawed filter does not sufficiently filter attributes,...

CVE-2026-122084

The WordsOnline Connector module integrates Drupal with the WordsOnline translation service through the TMGMT module. The module doesn't properly validate data, resulting in an SQL Injection vulnerability. An attacker can use this to read data from the Drupal database, including user account data...

CVE-2026-122077

The Allowed Languages module makes it possible to set restrictions on which content a user can edit based on language. The module doesn't sufficiently protect against using a disallowed language during content creation. This is mitigated by the fact that the user must have access to create conten...

CVE-2026-122074

This module enables you to reset passwords via one time passcode to email or SMS rather than reset password links. The module doesn't sufficiently validate resetting passwords for blocked users. This vulnerability is mitigated by the fact that someone with appropriate permissions must unblock the...

CVE-2026-122076

This module provides a separate page with a form for users to change their own password, which asks for the current password before accepting a new one. The module doesn't sufficiently verify the current password in some cases. This vulnerability is mitigated by the fact that an attacker must...

CVE-2026-122083

This module integrates the Site Catalyst or AdobeAnalytics software into a Drupal site. The module does not sufficiently provide access controls for advanced functionality, which exposes a cross-site scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must ha...

CVE-2026-122075

This module enables you to schedule content to be published or unpublished at a certain time in the future. The module doesn't sufficiently check if a user has permission to change publication or unpublication dates. This might cause certain information to be publicly disclosed ahead of the...

CVE-2026-122078

The Extended HTML Filter module allows using style attributes in CKEditor. The module XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting XSS vulnerability. The vulnerability is mitigated by the fact an attacker must be able to insert HTML...

CVE-2026-122073

The Name Field module provides a field for storing a personal name as separate components. The module does not sufficiently sanitize values under some circumstances. A name stored on the field can be interpreted as HTML, which can lead to a cross-site scripting XSS vulnerability...

CVE-2026-122072

This module allows forums to be set private and to be given moderators. The module doesn't sufficiently check access for creating forum topics in private forums. As a result, a user can post new topics in a forum where they should only have view access. This vulnerability is mitigated by the fact...

CVE-2026-122068

This module enables you to add syntax-highlighted code snippets to content using CKEditor 5. The module doesn't sufficiently validate input passed to its CKEditor 5 preview endpoint, leading to a reflected cross-site scripting XSS vulnerability...

CVE-2026-122057

This module enables you to upload files from the browser directly to Amazon S3 and register them as Drupal files, bypassing normal PHP file size and timeout limits. The module doesn't sufficiently check access to file uploads. Under certain scenarios, users can delete files they should not have...

CVE-2026-122058

This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with access tokens, or allow clients to request new access tokens and refresh them. The module doesn't sufficiently restrict access to consumer configuration. Users who can create or...

CVE-2026-122067

The REST & JSON API Authentication module provides API authentication for Drupal sites. The module does not properly reject requests when an API key is unconfigured, allowing unauthenticated attackers to bypass authentication and potentially access or modify protected resources. Sites are affecte...

CVE-2026-122066

This module enables you to send messages "Notifications" to users upon a certain Workflow state change. The module doesn't sufficiently protect the Notification settings page where an attacker can make unauthorized changes...

CVE-2026-122071

This module enables you to accept payments through Escrow.com with Drupal Commerce. The module doesn't sufficiently verify incoming Escrow.com webhook notifications. An attacker can forge payment and order status updates, marking unpaid orders as paid or completed, or cancelling orders that are i...

CVE-2026-122070

This module lets customers replace an item in their cart with one of the alternative product variations listed for it. The module does not check that a cart belongs to the current visitor when the visitor is not logged in. An anonymous visitor can view items in other anonymous visitors' carts,...

CVE-2026-122069

The AlternativeCommerce PayPal Checkout module provides an AlternativeCommerce method to embed payment services from PayPal. The module does not sufficiently validate incoming PayPal webhook requests. An unauthenticated attacker can submit a crafted request that references a payment record, causi...

CVE-2026-118547

The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files. A maliciously crafted import file can cause untrusted data to be deserialized PHP Object Injection, CWE-502, potentially leading to remote code execution...

CVE-2026-118566

The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files. The module doesn't sufficiently sanitize input passed to its client-side code, leading to a DOM-based cross-site scripting XSS vulnerability...

CVE-2026-115770

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.2.0 until 2.12.0, SendEmailVerification uses the token model in backend/internal/model/emailverificationtoken.go to bind an email-verification token only to the user's identifier, while...

CVE-2026-122038

A vulnerability was identified in krupalshah EmployeeRecruitmentSystem up to 922ff6d208278282e7c8e36d70d9ae356adec9fe. Affected by this issue is the function mysqlquery of the file source/reqformprocessing.php of the component Requirement Board Update Handler. Such manipulation leads to sql...

CVE-2026-62662

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 1.11.0 until 2.10.0, createTokenFromClientCredentials in backend/internal/service/oidcservice.go accepts the client-controlled resource parameter and embeds it directly in the access token aud...

CVE-2026-108387

radare2 is a UNIX-like reverse engineering framework and command-line toolset. Prior to 6.2.2, attacker-controlled data from several binary format plugins could reach RBinInfo-bclass. Opening or analyzing a crafted Pebble or Sega Mega Drive binary could place a dbg:// URI in bclass, causing radar...

CVE-2026-86041

ezBookkeeping is an open source, self-hosted personal finance application. From 0.10.0 until 1.6.0, ezBookkeeping constructs its Gin router with gin.New without configuring SetTrustedProxies, causing c.ClientIP to trust a spoofed X-Forwarded-For value. An unauthenticated remote attacker can suppl...

CVE-2026-76892

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server calls JSON.parse outside a request-local error boundary in the POST /mcp handler in integrations/mcp-server/src/index.ts. A single unauthenticated...

CVE-2026-76893

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.2, the HTTP mode of @tsparticles/mcp-server reuses one stateful StreamableHTTPServerTransport for every client. An unauthenticated client that sends the first initialize request without an...

CVE-2026-63655

tsParticles is a TypeScript library for creating highly customizable particle animations. Prior to 4.3.1, the HTTP mode of @tsparticles/mcp-server accepts unauthenticated POST /mcp requests in integrations/mcp-server/src/index.ts and accumulates every request-body chunk in a Buffer without a...

CVE-2026-102280

Sandboxie-Plus is an open source sandbox-based isolation software for Windows. Prior to 1.18.6, a process inside a sandbox could send MSGIDFILESETATTRIBUTES or MSGIDFILESETSHORTNAME to SbieSvc and cause the SYSTEM service to open and modify an existing file outside the sandbox. The direct primiti...

CVE-2026-57562

Readest is a modern, feature-rich ebook reader designed for seamless cross-platform access and an intuitive reading experience. Prior to 0.11.10, POST /api/stripe/check in apps/readest-app/src/app/api/stripe/check/route.ts accepted a client-controlled sessionId, retrieved the corresponding Stripe...