CVE-2026-92610

In esmf-sdk-py-aspect-model-loader versions 2.1.2 to 2.2.1, the Aspect Model loader resolves cross-file model references by extracting the third and fourth colon-separated components of any urn:samm:… namespace declared in a parsed Turtle file to build a directory to scan. A model file containing...

CVE-2026-113421

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, ThreadX Modules does not revoke a module's trace-buffer-full callback when the module is stopped and unloaded. With event tracing enabled and a kernel-owned trace buffer still active, a later buffer wrap invokes the callback from privileged...

CVE-2026-115231

In Eclipse ThreadX versions 6.0.1 through 6.5.2.202603, the Module Manager lets a user-mode, memory-protected module post a forged callback request to another module's callback request queue. The receiving module's callback thread calls the function pointer in the request without checking that th...

CVE-2026-74846

Catalyst::Plugin::Authentication versions before 0.10029 for Perl allow timing attacks on stored passwords via eq comparisons in the legacy password verifier. CVE-2026-5091 was fixed in the realm-based verifier. The legacy verifier, used by the deprecated login method, compares clear-text...

CVE-2026-103653

An out-of-bounds read vulnerability in the Qt CoAP message parsing QCoapInternalReply::createFromFrame of the Qt CoAP module. Processing a malformed CoAP message can cause an application using Qt CoAP to crash loss of availability or to continue operating on incorrect data potential loss of...

CVE-2026-120988

billboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improper sanitization of series ids during legend template rendering...

CVE-2025-5769

The authentication endpoint does not properly encode user-supplied input before rendering it within the web page. This lack of output encoding allows an attacker to inject malicious JavaScript payloads into the authentication flow, which are then executed by the victim's browser. By exploiting th...

CVE-2025-1397

When utilizing JWT Bearer or SAML2 Bearer grant types, the system fails to validate the status of the Identity Provider IDP before issuing access tokens. This oversight permits tokens to be generated even when the associated IDP has been disabled. A malicious actor could leverage this vulnerabili...

CVE-2026-120971

A flaw was found in RESTEasy's default exception mapper. When an unhandled exception other than a WebApplicationException is not handled by an application exception mapper, RESTEasy returns the exception's localized message in the HTTP 500 response body. A remote unauthenticated attacker who can...

CVE-2026-120831

A flaw was found in libslirp in ifoutput. When moving a session from the fast queue to the batch queue, the code unlinked and reinserted an arbitrary packet via ifm-mnextpkt instead of the session queue head, corrupting queue pointers. A guest generating burst traffic could crash the host...

CVE-2026-77526

"FacturaScripts\Core\UploadedFile::move$destiny, $destinyName" concatenates "$destiny" and "$destinyName" without normalizing the resulting path. Every caller in the codebase passes "UploadedFile::getClientOriginalName" — the unsanitized client-supplied filename — as "$destinyName", so an...

CVE-2026-105770

Octo STS github.com/octo-sts/app before 0.11.2 returns trust policy configuration to callers whose OIDC token does not satisfy that policy. TrustPolicy.CheckToken included the policy's issuer, subject and audience values or patterns and claimpattern names and regular expressions in its...

CVE-2026-120833

labbench before 0.46.1 contains a deserialization of untrusted data vulnerability in read and readrelational that passes any file with a .p or .pickle extension to pandas.readpickle based on the extension alone. Attackers who supply a crafted data file or relational data archive can execute...

CVE-2026-120830

A flaw was found in libslirp in icmpforwarderror. When building an ICMP error response, the length of the quoted original IPv4 packet was taken from the IP header without clamping it to the actual buffer length. A truncated or malformed packet could cause an out-of-bounds heap read, leaking host...

CVE-2026-38600

A Zip Slip vulnerability in the /upload endpoint of codeskyblue gohttpserver through v1.3.0 allows attackers to write arbitrary files via uploading a crafted Zip archive...

WS-2026-0180

CPython 3.11.0a7 through 3.11.18, 3.12.x through 3.12.16, 3.13.x before 3.13.16, 3.14.x before 3.14.8 and 3.15.0 pre-releases before 3.15.0rc2 index out of bounds in Pysubsparameters Objects/genericaliasobject.c when an argument gains typingsubst after a GenericAlias has cached its parameters...

CVE-2026-38601

A hardcoded session secret key in codeskyblue gohttpserver through v1.3.0 allows attackers to impersonate any user, bypass OpenID Connect authentication and access all controls via forged session cookies...

CVE-2026-106991

hustoj =24.09.10 and =26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread including admins' announcements via threadadmin.php. The thread branch only verifies login, never authorship or admin rights...

CVE-2026-120752

PyMuPDF 1.25.3 before 2.0 contains a stack-based buffer overflow vulnerability in JMsetannotcalloutline that copies a caller-supplied number of callout points into a fixed three-element stack array. Attackers who control the callout argument passed to Page.addfreetextannot can supply four or more...

CVE-2026-120740

A flaw was found in hivex. By supplying a specially crafted Windows registry hive file, an attacker can trigger an out-of-bounds memory read when hivex parses registry values containing malformed large data block lists. This issue can cause the application processing the registry file to crash,...

CVE-2026-115215

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, the NetX Secure DTLS server allocates a session from its fixed session pool for the first datagram from any unrecognised address and port, before the cookie exchange, and never releases a session whose handshake stalls. A remote,...

CVE-2026-115403

In Eclipse ThreadX NetX Duo versions 6.0 through 6.5.2.202603a, built with BSD raw socket and IPv6 support, the IPv6 raw send path uses the destination-table entry it adds without checking that the add succeeded. When the destination table is full and an off-link destination is reached through a...

CVE-2026-116635

Improper limitation of a pathname to a restricted directory in the deployment status component of the AWS Serverless MCP Server aws-serverless-mcp-server before v0.2.1 might allow an actor who can influence the MCP agent to read the contents of JSON files outside the intended deployment status...

CVE-2026-120091

Temporal Server compiles a Worker Controller Instance module, go.temporal.io/auto-scaled-workers, into its Worker Service, and that module registers a compute provider named k8s whose function is to manage workers running in a Kubernetes cluster. The k8s provider built its Kubernetes client from...

CVE-2026-116958

A flaw was found in konflux-ci. This vulnerability allows arbitrary code execution due to improper quoting of shell variables in deployment scripts. A local attacker who can supply arguments to the affected scripts could exploit this issue to trigger unintended command substitution, executing...

CVE-2026-120503

A vulnerability was detected in EchoHS GeekezBrowser up to 1.7.2/1.8.0. This affects an unknown part of the file /api/status of the component Public API. The manipulation results in information disclosure. The attack requires a local approach. The exploit is now public and may be used. Upgrading ...

CVE-2026-29508

ReadyMedia formerly MiniDLNA versions 1.3.0 through 1.3.3 contain a stack-based buffer overflow vulnerability that allows remote attackers to corrupt stack memory by crafting a malicious DFF audio file with an oversized PROP chunk size value that is used unvalidated to allocate a variable-length...

CVE-2026-58930

An unprivileged application can exploit a lack of package/signature validation in SystemUI's "RemoteQCController" when resolving a hardcoded "content://" URI. This allows the attacker to squat on a specific authority if the legitimate package is absent, inject spoofed UI elements into the trusted...

CVE-2026-58927

The vulnerability is a Use-After-Free UAF in the EVS AIDL HAL, arising from a data race on an unsynchronized "std::weakptr" within "EvsEnumerator::openCamera". Specifically, concurrent calls from a privileged UID e.g., "AIDAUTOMOTIVEEVS" can cause a torn "weakptr" state, leading to a virtual call...

CVE-2026-58926

A Use-After-Free UAF vulnerability exists in the EVS HAL, allowing a privileged client to free a "bufferhandlet" while the producer thread is still using it. This race condition, triggered via "doneWithFrame" and "setMaxFramesInFlight", enables an attacker to manipulate freed heap memory,...

CVE-2026-58925

The report details a heap Use-After-Free UAF vulnerability within the "android.hardware.automotive.evs-default" HAL service, stemming from unsynchronized access to an "std::unorderedmap". An unprivileged application with access to the EVS manager can trigger this UAF by making concurrent calls to...

CVE-2026-58924

The vulnerability is a heap out-of-bounds read in the EVS HAL's "getStreamList" method. An attacker can craft a "CameraDesc.metadata" byte array, which is parsed without validation, leading to an out-of-bounds read at an attacker-controlled offset within the HAL process's heap. The read data is...

CVE-2026-58915

A physical occupant on an Android Automotive OS AAOS Multi-User Multi-Display MUMD passenger display can view sensitive Heads-Up Notification HUN content and execute actions for a secure passenger user User N without authenticating. This bypasses the PassengerKeyguard because the HUN system only...

CVE-2026-49906

An unprivileged application can bypass the "android.car.permission.CARDISPLAYINCLUSTER" permission by registering an activity with the "android.car.cluster.NAVIGATION" category and requesting navigation app focus. The privileged "ClusterHomeSample" application, acting as a confused deputy, resolv...

CVE-2026-49903

The "ClusterRenderingService.dump" method, accessible to processes holding "android.permission.DUMP" and "android.permission.PACKAGEUSAGESTATS", acts as a confused deputy. It allows attackers to write arbitrary values to "Settings.Global.OVERLAYDISPLAYDEVICES", an operation normally requiring...

CVE-2026-120689

HDF5 through 2.2.0 contains an uncontrolled recursion vulnerability in H5Biteratehelper in src/H5B.c. When iterating a version 1 B-tree, the function does not verify that a child node’s level matches the expected level. That check is performed only in H5Bcachedeserialize when a node is first load...

CVE-2026-120067

For updatable cursors, which are enabled by default, psqlODBC adds hidden ctid and, for tables with OIDs, oid columns to the query. It copies each value into a 32-byte stack buffer using the length the server sent, without checking it against the buffer size, so a value of 32 bytes or more writes...

CVE-2026-120066

On Unix-like systems, when logging is enabled, psqlODBC creates its log files in /tmp by default, named from the program name, user name, and process ID, with the default permissions, typically world-readable, and follows symbolic links when opening them. A local user can read query text and data...

CVE-2026-120065

For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC uses that column to identify rows. It places the column's name, as reported by the server, between double quotes in its keyset queries and in the WHERE clause of its positioned SELECT, UPDATE, and...

CVE-2026-120064

Several psqlODBC entry points use an application-supplied column number or row index as an array index without validating it. SQLBindCol with a column number above 32767 wraps the binding count negative and a later copy runs off the array. A negative SQLDESCCOUNT on an application row descriptor...

CVE-2026-120063

When psqlODBC quotes a schema or table name into a 128-byte stack buffer, its length check lets it write up to two bytes past the end of the buffer for a long name. The names come from the application's SQL text: the table of a statement the driver parses to describe its columns, and the target o...

CVE-2026-120062

SQLSpecialColumns in psqlODBC splices the table and schema names it receives into its catalog query without escaping them, while the other catalog functions escape them. An application that passes an untrusted table or schema name to SQLSpecialColumns lets the caller execute arbitrary SQL with th...

CVE-2026-120061

The psqlODBC parser for ODBC escape sequences in application SQL text writes the argument offsets of a fn escape into a fixed 16-entry stack array without a bound and does not initialize the array. An escape with too many arguments overflows the stack, and a reference to an unsupplied argument...

CVE-2026-120059

For an updatable cursor over a table without OIDs that has an auto-increment int4 column, psqlODBC places that column's name, as reported by the server, into a printf-style format string. It later expands that string with one argument while it builds the WHERE clause of its positioned SELECT,...

CVE-2026-120060

psqlODBC trusts counts and lengths in server data in three places. SQLBulkOperations uses a server-supplied row count in a size subtraction that can underflow. SQLStatistics iterates index keys using a server-supplied key count without bounding it to the fixed storage. Bytea octal decoding reads ...

CVE-2026-120058

psqlODBC sizes its row cache from the column count of a cursor's first result, but recomputes the column count from each later FETCH reply without checking that it matches. A server not trusted under current SSL settings can answer a later FETCH with more columns and make the driver write tuple...

CVE-2026-120057

psqlODBC copies the reply to a large-object read loread into the application's buffer using the length sent by the server, without comparing it to the buffer size. A server not trusted under current SSL settings, or a man-in-the-middle, can return more bytes than the buffer holds and overwrite...

CVE-2026-120497

Stored cross-site scripting XSS in the HTML report generator in the aidlc-traceability CLI in AWS AI-DLC Workflows before 2026-07-03 might allow an actor who can modify a project's AI-DLC artifact files to execute arbitrary script in the browser of a user who opens a generated HTML traceability...

CVE-2026-120656

OpenKruise kruise-manager exposes an unauthenticated ppof endpoint when enabled, opening it on 0.0.0.0:8090, which can enable a DoS attack triggerable by any RBAC pod...

CVE-2026-81938

Grafana Mimir's Alertmanager rejects tenant-supplied receiver configurations that reference local files, but the check did not cover two HTTP client settings: httpheaders..files and basicauth.usernamefile. A tenant permitted to upload an Alertmanager configuration could point these fields at any...