CVE-2026-121627

buku 5.0 through 5.1.1 contains a stored cross-site scripting vulnerability in the bukuserver bookmark list that allows attackers to execute script via an unescaped bookmark URL in BookmarkModelView.listentry. Attackers can submit a URL containing a double quote and event handler through the...

CVE-2026-121626

GNU Gatekeeper gnugk before 5.16 contains an out-of-bounds read vulnerability in H46024Socket::ReceivedProbePacket that allows remote attackers to cause a heap over-read by sending short probe packets. Attackers can send a short application-defined RTCP packet to the media port during H.460.24...

CVE-2026-121625

GNU Gatekeeper gnugk before 5.16 contains an out-of-bounds read vulnerability in ParseRTCP in ProxyChannel.cxx that allows remote RTP peers to read heap memory past received packets. Attackers can send RTCP SDES items lacking a NUL byte to the media proxy port during proxied H.323 calls with...

CVE-2026-121631

Lightdash 0.2609.0 before 3.137.0 contains an authorization bypass vulnerability in the RenameService that allows authenticated users with update Project permission on one project to access and modify dashboards belonging to a different project, caused by the failure to verify that the projectUui...

CVE-2026-121262

A vulnerability was found in phpMyAdmin SQL-Parser 6.0.0/6.0.1. The affected element is the function parse of the file src/Statements/ExplainStatement.php. Performing a manipulation of the argument nextToken results in incorrect type conversion. The attack is possible to be carried out remotely...

CVE-2026-115716

Allocation of Resources Without Limits or Throttling CWE-770 in APM Server can lead to denial of service via Oversized Serialized Data Payloads CAPEC-231. An attacker who can send OpenTelemetry OTLP data to APM Server over HTTP can cause APM Server to exhaust its memory and terminate. This stops...

CVE-2026-115715

Allocation of Resources Without Limits or Throttling CWE-770 in Elasticsearch can lead to denial of service via a specially crafted input value that is processed by an affected phonetic encoder of the analysis-phonetic plugin. An authenticated user with permission to write documents to or run...

CVE-2026-115710

Use of Cache Containing Sensitive Information CWE-524 in Elasticsearch can lead to information disclosure and incorrect search results via specially crafted search requests. For some query types, Elasticsearch can share cached query results between users who have field-level security restrictions...

CVE-2026-115298

Incorrect Authorization CWE-863 in Elasticsearch can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user whose index access is restricted by field-level security can retrieve the value of a constantkeyword field that their rol...

CVE-2026-115297

NULL Pointer Dereference CWE-476 in the AMQP protocol parser in Packetbeat can lead to denial of service via specially crafted network traffic. An unauthenticated attacker who can send traffic on a network segment that Packetbeat monitors for AMQP can cause a Go runtime panic that terminates the...

CVE-2026-115295

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with read access to connectors in one Kibana space can retrieve connector execution log information fro...

CVE-2026-115293

Insertion of Sensitive Information Into Sent Data CWE-201 in Kibana Observability onboarding can lead to disclosure of the credentials that Kibana uses to connect to Elasticsearch. When these credentials are embedded in the Elasticsearch host URLs in the Kibana configuration, an authenticated use...

CVE-2026-115292

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana Machine Learning can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with Machine Learning read access in one Kibana space can read the audit and error...

CVE-2026-115290

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads CAPEC-230. An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate...

CVE-2026-115289

Use of Multiple Resources with Duplicate Identifier CWE-694 in APM Server can lead to information disclosure via a specially crafted agent configuration request. An authenticated APM agent could receive the central agent configuration that belongs to a different service until the cached...

CVE-2026-121261

A vulnerability has been found in phpMyAdmin ShapeFile up to 4.0.1. Impacted is the function ShapeRecord::loadFromFile of the component SHP File Handler. Such manipulation leads to infinite loop. The attack can be executed remotely. The exploit has been disclosed to the public and may be used. Th...

CVE-2026-121259

A flaw was found in the GStreamer JPEG 2000 decimator in gst-plugins-bad. Crafted JPEG 2000 media can cause integer overflows or division by zero during tile processing. An application that processes the malicious media may crash, resulting in a denial of service...

CVE-2026-121604

wlroots before 0.20.2 contains an out-of-bounds read vulnerability in readsurfaceclass in xwayland/xwm.c that allows local X11 clients to leak compositor heap memory. Attackers can set a WMCLASS property with a NUL-terminated instance but unterminated class, exposing over-read heap bytes as the...

CVE-2026-121602

Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server to corrupt memory by sending overlong channel names in JOIN or SJOIN messages. Attackers controlling a peer server can trigger strcpy and sprintf overflows in msjoin and mssjoin...

CVE-2026-121603

Solanum before commit 2ea1382 contains a buffer overflow vulnerability in mskill that allows malicious linked servers to corrupt memory by sending an overlong kill reason. Attackers controlling a rogue or compromised peer server can send a reason exceeding KILLLEN that overflows a static 512-byte...

CVE-2026-121588

TeXlyre from 0.11.0 before 0.13.5 contains a stored cross-site scripting vulnerability that allows attackers to execute script by supplying malicious LSP or typesetter recipe icons. Attackers can trick victims into importing a recipe whose icon contains an HTML event handler, persistently accessi...

CVE-2026-119674

MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the corresponding dump filename has been truncated. A database user who can create and populate a suitably encoded collection can cause a later authorized directory restore to write tho...

CVE-2026-119673

MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for getregex. An unauthorized user who can both upload a GridFS file and place a symlink in the operator's download working directory can cause a later retrieval to create a file...

CVE-2026-119672

MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for getid when --local is not specified. A user who can modify the file metadata can set the stored filename to '-', causing a later authorized retrieval to write the file contents to standard outpu...

CVE-2026-119675

MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace filters, causing a restore to create an unauthorized...

CVE-2026-118505

Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ashauthentication allows an unauthenticated attacker to guess passwords and one-time passwords without limit. The password, magic link and OTP strategies enforce bruteforcestrategy by adding a preparation only...

CVE-2026-119215

Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ashauthentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor...

CVE-2026-114582

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. "django.contrib.gis.gdal.SpatialReference" and related "transform" methods and "srs"/"srid" setters do not restrict GDAL’s file and network access when parsing string input, which allows attackers to...

CVE-2026-113733

An issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10. The "django.contrib.admin.utils.displayforfield" function did not obfuscate the password field of user models other than "AUTHUSERMODEL", or of an "AUTHUSERMODEL" inheriting its password field from a concrete parent model...

CVE-2026-113593

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. The "django.middleware.cache.UpdateCacheMiddleware" and the "django.views.decorators.cache.cachepage" decorator generate identical cache keys for requests that omit a header listed in the response’s "Var...

CVE-2026-111362

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. "django.contrib.gis.gdal.OGRGeometry" does not restrict external coordinate reference system definitions in GeoJSON input, which allows remote attackers to cause server-side requests to attacker-selected...

CVE-2026-111211

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. "django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize", used by "django.contrib.gis.forms.GeometryField", does not escape invalid submitted values before logging them, which allows remote...

CVE-2026-108147

An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19. "django.http.multipartparser.MultiPartParser" is subject to excessive memory consumption when processing multipart file uploads with base64 "Content-Transfer-Encoding", which could be buffered...

CVE-2026-120758

HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HLunprotect in src/H5HL.c. H5HLprotect pins a single metadata cache entry for a local heap, either the heap prefix or the separate data block, and H5HLunprotect unpins it on the final unprotect. When the metadata cache...

CVE-2026-65168

NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code...

CVE-2026-65165

NVIDIA Slurm contains a vulnerability where a user could deliberately alter the provided nodelist alongside the --distribution=arbitrary option to gain access to compute nodes outside of the current job allocation...

CVE-2026-65140

NVIDIA Slurm contains some inconsistent authorization checks against the Operator permission level in the SlurmDBD that can be chained together in a way that would permit an Operator to make themselves an Administrator...

CVE-2026-65139

NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary code execution...

CVE-2026-120757

HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5Lexterntraverse in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link’s user data using strlen without validating the buffer against...

CVE-2026-65138

NVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API that could be used to ex-filtrate authentication keys...

CVE-2026-65109

NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could allow an attacker to remove files outside of their control on the compute node...

CVE-2026-120756

HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5Ochunkdeserialize in src/H5Ocache.c. When decoding object header messages, the declared message size is checked against the end of the chunk image before the remainder of the message header flags, and for version 2 object...

CVE-2026-120755

HDF5 through 2.2.0 contains an out-of-bounds read vulnerability in H5Zfilterszip in src/H5Zszip.c. When decoding a szip-compressed chunk, the function subtracts the 4-byte uncompressed-length header from the chunk length without first verifying that the chunk is at least 4 bytes long. A truncated...

CVE-2026-118487

In Eclipse Vert.x versions 4.0.0, 4.5.35 or 5.0.0, 5.2.2, the "FrameParser" in vertx-stomp creates a "RecordParser" without setting "maxRecordSize", so any peer that streams bytes continuously without a newline character causes the parser to accumulate data indefinitely. Both the STOMP server and...

CVE-2026-119741

rsync through 3.5.1 contains a denial of service vulnerability in the delta-transfer sender's hashsearch in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attackers pulling from a public daemon module can supply weak...

CVE-2026-121564

Incomplete Comparison with Missing Factors CWE-1023 in mergechats whatstk/utils/chatmerge.py, reached from BaseChat.merge, in whatstk from 0.3.0 before 0.9.0 allows a party that supplies the chat exports to cause messages to be absent from the merged output with no indication that anything was...

CVE-2026-120754

HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Zfilterscaleoffset in src/H5Zscaleoffset.c. The decode path validates reads against the allocated size of the chunk buffer rather than the number of bytes actually read from the file. Because H5Dchunklock deliberately siz...

CVE-2026-97350

Securepoint SSL VPN Client v2 on Windows contains vulnerabilities in the handling of OpenVPN configurations and proxy settings that allow non-privileged local users to influence operations performed with NT AUTHORITY\SYSTEM privileges. Two attack vectors have been identified: Improper authorizati...

CVE-2026-65108

NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd process while the slurmstepd is running with root permissions...

CVE-2026-65107

NVIDIA Slurm contains a vulnerability where a user could alter the supplemental group list as part of an sbcast file transmission to write a file to a path they would not normally have access to...