CVE-2026-122311

Kyverno from 1.16.0 before 1.19.2 fails to validate path segments in the resource argument of resource.get and resource.post, allowing namespaced CEL policies to escape their namespace. Tenants who can create a NamespacedValidatingPolicy can insert .. segments to read and write arbitrary cluster...

CVE-2026-122309

Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespace-scoped policy authors to exhaust CPU and memory by submitting CEL expressions evaluated without runtime cost limits. Attackers can create a NamespacedValidatingPolicy or NamespacedDeletingPolicy with nested map...

CVE-2026-122310

Kyverno from 1.19.1 before 1.19.2 validates a Policy's context.apiCall urlPath after cleaning it but executes the raw path, whose fragment or query the Kubernetes client discards. A namespace-scoped user who can create a Policy can hide ../ segments behind or ? to reach cluster-scoped endpoints...

CVE-2026-122308

Kyverno before 1.19.2 contains an authorization bypass vulnerability in the Generation Handler that allows users with create/update permissions to trigger synchronized generate policies by spoofing internal generate.kyverno.io labels. Attackers can label a ConfigMap as managed-by kyverno with...

CVE-2026-122307

Kyverno before 1.19.2 contains a policy bypass vulnerability in the admissionpolicygenerator controller, which folds PolicyExceptions into generated ValidatingAdmissionPolicies while ignoring the --enablePolicyException, --exceptionNamespace, and policy kind gates. Users with namespaced create...

CVE-2026-122306

Kyverno before 1.19.2 contains a denial of service vulnerability that allows namespaced policy authors to exhaust admission controller CPU by submitting pathological wildcard patterns. Attackers can create a Policy with crafted match and exclude names evaluated by ValidateMatchExcludeConflict,...

CVE-2026-122305

Kyverno before 1.19.2 contains a denial of service vulnerability in substituteVariablesIfAny that allows low-privileged users to hang the admission webhook via self-referential variable templates. Attackers can create resources whose annotations re-introduce the embedded policy variable, causing...

CVE-2026-122304

Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace admins to escape namespace confinement because the cleanup controller builds its context loader with a nil policy. Attackers can create a namespaced CleanupPolicy with apiCall or globalReference...

CVE-2026-122303

Kyverno from 1.17.0 before 1.19.2 contains an authorization bypass vulnerability that allows namespace tenants to overwrite resources in other namespaces via NamespacedMutatingPolicy mutate-existing targetMatchConstraints.expression. Attackers can return a CEL map literal fabricating a target wit...

CVE-2026-122301

Parse Server before 8.6.114 and 9.0.0 before 9.10.6-alpha.6 returns field values in object create responses to callers that lack read access to the created object through class-level permissions or the object's ACL. An attacker with create permission can create objects to obtain values set by Clo...

CVE-2026-122302

Kyverno before 1.19.2 contains a privilege escalation vulnerability that allows namespace admins to create resources beyond their RBAC because generate-rule admission checks verify the controller's permissions, not the author's. Attackers can create a namespaced Policy with generate rules targeti...

CVE-2026-122159

A weakness has been identified in Edge0-AI Audio8TTS up to 1d64afcc2da56222b41ddcf53de7b8bc54be1fb6. This affects the function ArkTtsRuntime.init of the file onnxruntime01bint8/arkttsruntime/runtime.py of the component Model Path Resolution. Executing a manipulation of the argument slowdecodemode...

CVE-2026-122158

A security flaw has been discovered in InvoiceShelf up to 2.4.3/3.0.0-alpha.3. Affected by this issue is the function MemberService::create of the file app/Domains/Accounts/Application/MemberService.php. Performing a manipulation of the argument companies.id/companies.role results in improper...

CVE-2026-122157

A vulnerability was identified in Purocean Yank Note 3.93.0. Affected by this vulnerability is the function checkPermission of the file src/main/server/index.ts of the component Terminal Handler. Such manipulation leads to os command injection. The attack can be executed remotely. The exploit is...

CVE-2026-122154

A vulnerability was found in purocean Yank Note 3.93.0. This impacts the function config.getAll of the file src/main/server/index.ts of the component Settings Endpoint. The manipulation results in information disclosure. The attack may be launched remotely. The exploit has been made public and...

CVE-2026-122151

A security vulnerability has been detected in Presenton up to 0.9.11-beta. Impacted is the function JSON.parse of the file /api/user-config of the component User Configuration Handler. Such manipulation leads to cross-site request forgery. It is possible to launch the attack remotely. The exploit...

CVE-2026-122146

A weakness has been identified in 101arrowz fflate up to 0.8.3. This issue affects the function unzipSync of the file esm/index.mjs. This manipulation causes memory corruption. It is possible to initiate the attack remotely. The exploit has been made available to the public and could be used for...

CVE-2026-109849

Incorrect privilege assignment issue exists in Hinemos. If this vulnerability is exploited, an attacker who can access the password change API with specific permissions that can be assigned to non-administrative users may change the password of an administrative user...

CVE-2026-122144

A security flaw has been discovered in nliautaud pico-content-editor up to 02d5ad6c820c5050c542ab9505819b5e0a0ba1af. This vulnerability affects unknown code. The manipulation results in cross-site request forgery. The attack may be performed from remote. The exploit has been released to the publi...

CVE-2026-122052

A vulnerability has been found in laspy up to 2.7.0. Affected by this issue is some unknown functionality of the file laspy/lasreader.py of the component LAS File Handler. The manipulation leads to uncontrolled memory allocation. Remote exploitation of the attack is possible...

WS-2026-0184

inflateGetDictionary in zlib inflate.c 1.2.7.1 through 1.3.2 can write up to 8 MB past the caller's 32 KB dictionary buffer. With windowBits 0, inflate takes the window size from the zlib header and stores an invalid size of up to 2^23 before rejecting it, and inflateReset/inflateSync keep it...

WS-2026-0182

The zipRemoveExtraInfoBlock function in the minizip contrib library shipped with zlib contrib/minizip/zip.c 1.2.3.5 through 1.3.2 reads each extra-field block size as a signed 16-bit value and never checks it against the buffer length, so a crafted ZIP extra field for example from an untrusted...

WS-2026-0179

OpenSSH sshd password authentication bypass on Linux systems that use musl libc with PAM disabled e.g. Alpine Linux, OpenWrt, Buildroot/Yocto musl builds. Since OpenSSH 7.3p1, when the target account's password field is '', sysauthpasswd passes a NULL salt and xcrypt borrows the salt of another...

WS-2026-0183

In zlib inflate.c 1.2.3.5 through 1.3.2, calling inflateSync with windowBits 0 before a zlib/gzip header has been read leaves the window size at zero, so inflate allocates a one-byte window. If the stream is then reused with inflateReset2 and a crafted header sets a real window size, updatewindow...

CVE-2026-122299

Dulwich before 1.2.20 contains a commit object parsing vulnerability where the read path in parsecommit resolves a duplicate tree header to the last occurrence instead of the first, diverging from core git's resolution behavior, while Poetry 2.5.1 ships this version and uses dulwich by default fo...

CVE-2026-102337

Webmin is a web-based system administration tool for Unix-like servers. Prior to 2.652, untrusted users with access to the File Manager or Upload and Download modules can direct Webmin's server-side URL download functionality to non-public network addresses because download destinations are not...

CVE-2026-77372

VeraCrypt provides disk encryption with strong security based on TrueCrypt. Prior to 1.26.30, the Unix, macOS, and FreeBSD serialization paths in src/Platform/Serializer.cpp and src/Volume/VolumePassword.cpp accept untrusted length and count values when deserializing data that can cross from the...

CVE-2026-97702

Open edX Platform enables the authoring and delivery of online learning at any scale. From the Ulmo release until release/ulmo.4 and release/verawood.1, the GET /api/support/v1/managecourseteam/ endpoint in CourseTeamManageAPIView requires only IsAuthenticated and omits the global support-role...

CVE-2026-62365

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. DecodeWinevt in src/analysisd/decoders/winevtchannel.c accumulates unnamed Windows EventChannel Data element contents into the fixed 65,535-byte joindata heap buffer but passes t...

CVE-2026-122080

The htmLawed module enables use of the "htmLawed" https://bioinformatics.org/phplabware/internalutilities/htmLawed/index.php PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input. The module's filtering of malicious HTML can be bypassed by using a malformed...

CVE-2026-122079

The htmLawed module enables use of the "htmLawed" htmLawed website: https://bioinformatics.org/phplabware/internalutilities/htmLawed/index.php PHP library as a filter in a Text Format for restriction/filtering of HTML in textual input. The htmLawed filter does not sufficiently filter attributes,...

CVE-2026-122084

The WordsOnline Connector module integrates Drupal with the WordsOnline translation service through the TMGMT module. The module doesn't properly validate data, resulting in an SQL Injection vulnerability. An attacker can use this to read data from the Drupal database, including user account data...

CVE-2026-122077

The Allowed Languages module makes it possible to set restrictions on which content a user can edit based on language. The module doesn't sufficiently protect against using a disallowed language during content creation. This is mitigated by the fact that the user must have access to create conten...

CVE-2026-122074

This module enables you to reset passwords via one time passcode to email or SMS rather than reset password links. The module doesn't sufficiently validate resetting passwords for blocked users. This vulnerability is mitigated by the fact that someone with appropriate permissions must unblock the...

CVE-2026-122076

This module provides a separate page with a form for users to change their own password, which asks for the current password before accepting a new one. The module doesn't sufficiently verify the current password in some cases. This vulnerability is mitigated by the fact that an attacker must...

CVE-2026-122083

This module integrates the Site Catalyst or AdobeAnalytics software into a Drupal site. The module does not sufficiently provide access controls for advanced functionality, which exposes a cross-site scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must ha...

CVE-2026-122078

The Extended HTML Filter module allows using style attributes in CKEditor. The module XSS filter does not sufficiently sanitize certain HTMX attributes, which can lead to a cross-site scripting XSS vulnerability. The vulnerability is mitigated by the fact an attacker must be able to insert HTML...

CVE-2026-122073

The Name Field module provides a field for storing a personal name as separate components. The module does not sufficiently sanitize values under some circumstances. A name stored on the field can be interpreted as HTML, which can lead to a cross-site scripting XSS vulnerability...

CVE-2026-122075

This module enables you to schedule content to be published or unpublished at a certain time in the future. The module doesn't sufficiently check if a user has permission to change publication or unpublication dates. This might cause certain information to be publicly disclosed ahead of the...

CVE-2026-122072

This module allows forums to be set private and to be given moderators. The module doesn't sufficiently check access for creating forum topics in private forums. As a result, a user can post new topics in a forum where they should only have view access. This vulnerability is mitigated by the fact...

CVE-2026-122058

This module introduces an OAuth 2.0 authorization server, which can be configured to protect your Drupal instance with access tokens, or allow clients to request new access tokens and refresh them. The module doesn't sufficiently restrict access to consumer configuration. Users who can create or...

CVE-2026-122057

This module enables you to upload files from the browser directly to Amazon S3 and register them as Drupal files, bypassing normal PHP file size and timeout limits. The module doesn't sufficiently check access to file uploads. Under certain scenarios, users can delete files they should not have...

CVE-2026-122068

This module enables you to add syntax-highlighted code snippets to content using CKEditor 5. The module doesn't sufficiently validate input passed to its CKEditor 5 preview endpoint, leading to a reflected cross-site scripting XSS vulnerability...

CVE-2026-122067

The REST & JSON API Authentication module provides API authentication for Drupal sites. The module does not properly reject requests when an API key is unconfigured, allowing unauthenticated attackers to bypass authentication and potentially access or modify protected resources. Sites are affecte...

CVE-2026-122066

This module enables you to send messages "Notifications" to users upon a certain Workflow state change. The module doesn't sufficiently protect the Notification settings page where an attacker can make unauthorized changes...

CVE-2026-122071

This module enables you to accept payments through Escrow.com with Drupal Commerce. The module doesn't sufficiently verify incoming Escrow.com webhook notifications. An attacker can forge payment and order status updates, marking unpaid orders as paid or completed, or cancelling orders that are i...

CVE-2026-122070

This module lets customers replace an item in their cart with one of the alternative product variations listed for it. The module does not check that a cart belongs to the current visitor when the visitor is not logged in. An anonymous visitor can view items in other anonymous visitors' carts,...

CVE-2026-122069

The AlternativeCommerce PayPal Checkout module provides an AlternativeCommerce method to embed payment services from PayPal. The module does not sufficiently validate incoming PayPal webhook requests. An unauthenticated attacker can submit a crafted request that references a payment record, causi...

CVE-2026-118547

The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files. A maliciously crafted import file can cause untrusted data to be deserialized PHP Object Injection, CWE-502, potentially leading to remote code execution...

CVE-2026-118566

The Content Synchronizer module allows content to be exported and imported between Drupal sites via uploaded archive files. The module doesn't sufficiently sanitize input passed to its client-side code, leading to a DOM-based cross-site scripting XSS vulnerability...