CVE-2026-116247

When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one could not be found, pgAdmin left the parameter out of the connection and libpq fell back to the defaults of the operating-system account running pgAdmin: /.pgpass,...

CVE-2026-116246

To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrote it into pgAdmin's own process environment: as PGPASSWORD for the PSQL tool, and under a per-process variable for a utility. Nothing removed it afterwards. pgAdmin's environmen...

CVE-2026-116244

When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME from its environment, so the Kerberos library fell back to the default credential cache, or a client keytab, of the operating-system account running pgAdmin. libpq then answered an...

CVE-2026-116245

libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry there can hold a password or name a password file or client certificate. In server mode any user could set a server's Service, or a "service" connection parameter, to one of tho...

CVE-2026-116243

pgAdmin 4 runs pgdump, pgrestore, pgdumpall and psql from the binary path a user sets in their preferences. In server mode the binary path was refused only when it lay under the per-user storage directory STORAGEDIR, not under a SHAREDSTORAGE directory, which ordinary users can upload files to. A...

CVE-2026-116241

pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy ... TO command and checks that the query's parentheses are balanced so that nothing can escape the wrapper. The check rejected a backslash inside a single-quoted string, but not inside a double-quoted identifier, wher...

CVE-2026-116242

pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither hostpkeydirectories nor sshconfigfile, so it always loaded the unencrypted private keys in /.ssh of the operating-system account running pgAdmin, read that account's /.ssh/config IdentityFile, User, HostName, ProxyCommand...

CVE-2026-116240

In server mode pgAdmin 4 validates a path into the user's storage directory with checkaccesspermission, which builds the absolute path with getabspath. Several callers then acted on a path they built differently, so the path checked and the path used could name different files: - Opening a file i...

CVE-2026-116239

In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example, an internal account and an LDAP account. After LDAP or Kerberos authenticated a user, pgAdmin chose the account to log in by username alone, or took the account Flask-Security's...

CVE-2026-116238

In server mode pgAdmin 4 locks an internal account after MAXLOGINATTEMPTS failed logins 3 by default. The limit could be bypassed, giving an unauthenticated attacker an unlimited number of password guesses against any internal account, including the administrator's, in the default configuration: ...

CVE-2026-61694

go-xrpl is a Go implementation of the XRP Ledger protocol. In versions through the June 18, 2026 revision identified by the advisory, "ParseMPTAmountBinary" in "internal/ledger/state/ripplestate.go" converts the eight-byte MPT magnitude using "num.Int64" without checking that it fits in 63 bits. ...

CVE-2026-119330

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.2.0, the shared-link creation API accepted albumId and assetIds as independent fields in server/src/services/shared-link.service.ts but authorized only the resource selected by the requested link type. An...

CVE-2026-119329

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.0.0, GET /api/map/markers used server/src/services/map.service.ts to add partner owner identifiers when withPartners=true, while server/src/repositories/map.repository.ts applied Archive visibility to every...

CVE-2026-119328

Immich is a high-performance self-hosted photo and video management solution. Prior to 3.3.0, the unauthenticated machine-learning /predict endpoint in machine-learning/immichml/main.py accepted an options object and passed its values into model construction in...

CVE-2026-61850

Kargo manages and automates the promotion of software artifacts. From 0.6.0 until 1.8.14, 1.9.9, and 1.10.8, two authorization flaws in the "project-scoped RBAC API" let an authenticated user with delegated permission to manage a Project's "Roles" or "ServiceAccounts" confer permissions exceeding...

CVE-2026-55598

PinePods is a complete, self-hosted podcast management system written in Rust. Prior to 0.9.0, an authenticated user can subscribe to an attacker-controlled RSS feed through "POST /api/data/addpodcast" in "rust-api/src/handlers/podcasts.rs". "getpodcastvalues" and "addepisodes" in...

CVE-2026-62302

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, "server.ts" calls "registerStaticRoutes" and "registerCloudRoutes" before "registerApiRoutes", where "authMiddleware" and "roleBasedAuthMiddleware" are mounted. Because Express processes middleware ...

CVE-2026-62301

MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, backend video access does not enforce the visitor role's intended public-only restriction when "loginEnabled=true" and a visitor password is configured. The frontend filter in "VideoContext.tsx" is...

CVE-2026-55493

HotCRP is conference review software. Starting with 2.101, the "cmt:" search term checks whether a comment is visible to the searching user but fails to check whether the commenter's identity should be visible. A "cmt:USER" search can therefore match a paper with a visible comment authored by USE...

CVE-2026-62284

OSAC operator is a Kubernetes operator. In the affected revision identified as 8220502, the "console-proxy" "RemoteConfigResolver" parses Kubernetes Secret kubeconfig data with "clientcmd.RESTConfigFromKubeConfig" without sanitizing the resulting "rest.Config". An attacker who can create or modif...

CVE-2026-62331

praktor is a multi-agent Claude Code orchestrator with Telegram input and output, Docker isolation, and a Mission Control UI. Prior to 0.9.1, both Telegram upload sites in "internal/telegram/bot.go" concatenate the attacker-controlled document filename into a destination path without sanitization...

CVE-2026-61586

Copernik XML Factory provides secure-by-default JAXP factory creation for Java. Prior to 0.1.2, Copernik XML Factory does not block XInclude resource resolution on the stock JDK provider after an application enables XInclude on a factory returned by "XmlFactories.newDocumentBuilderFactory" or...

CVE-2026-62303

Pistache is a high-performance REST toolkit written in C++. From 0.0.5 through 0.4.26, "SegmentTreeNode::sanitizeResource" in "src/server/router.cc" uses "std::regexreplace" with the "//+" expression to collapse consecutive slashes. With libstdc++, a path containing tens of thousands of consecuti...

CVE-2026-62298

mouse07410/asn1c is an ASN.1 compiler. Prior to 1.2.5, "OPEN TYPE" decoding can dereference an unallocated member pointer and crash the consuming program. "OPENTYPEaperget" in "OPENTYPEaper.c", "OPENTYPEberget" in "OPENTYPEber.c", "OPENTYPEoerget" in "OPENTYPEoer.c", and "OPENTYPEuperget" in...

CVE-2026-59978

AdminNeo is a full-featured database management tool written in PHP. From 4.6.2 until 5.5.0, the unauthenticated "?script=version" endpoint accepts POST data without origin, CSRF or parameter-type validation. A "version" parameter becomes a PHP array that "bootstrap.inc.php" serializes into the...

CVE-2026-120046

Nezha 2.0.0 before 2.4.0 contains a NULL pointer dereference vulnerability in ServiceSentinel.loadTodayStats that allows authenticated users to crash the dashboard by deleting a service. Attackers can delete their own service via POST /api/v1/batch-delete/service, leaving orphaned servicehistorie...

CVE-2026-120007

NodeBB 1.18.0 through 4.16.5 contains an authorization bypass vulnerability that allows unauthenticated visitors to act on other accounts by supplying a uid during POST /register. Attackers can submit an empty email at the /register/complete interstitial to clear a victim's email and confirmation...

CVE-2026-119842

A flaw was found in GStreamer's gst-plugins-base MicroDVD subtitle parser. When processing a specially crafted subtitle file, the parser may dereference a NULL pointer, causing the application to crash when a user opens or plays media with a malformed MicroDVD .sub subtitle file...

CVE-2026-119727

A flaw was found in GStreamer's gst-plugins-bad H.265 video parser. When parsing a specially crafted H.265 bitstream containing a Screen Content Coding SCC extension with certain palette predictor initializer settings, an integer underflow in the upper-bound computation allows the parser to accep...

CVE-2026-61848

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when Crass parses input containing "non-ASCII characters", inefficiencies in tracking the positions of "multi-byte characters" result in superlinear parsing time. An attacker-controlled CS...

CVE-2026-61847

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, when the ":preservecomments" option is not enabled, which is the default, Crass discards CSS comments by recursively consuming the next token. An attacker-provided stylesheet containing a...

CVE-2026-61846

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass recursively parses "CSS simple blocks and functions" without a depth guard. An attacker-controlled CSS value containing deeply nested blocks or functions can recurse until Ruby raise...

CVE-2026-61845

Crass is a Ruby CSS parser that's fully compliant with the CSS Syntax Level 3 specification. Prior to 1.0.7, Crass converts "CSS scientific notation" number values with unbounded exponentiation before clamping the result to "Float::MAX". Applications that use Crass to parse attacker-controlled CS...

CVE-2026-46560

Open Access Management OpenAM is an access management solution. Prior to 16.1.1, the "RADIUS" authentication module opens an unconnected datagram socket and trusts the first UDP datagram received on the client source port. The receive path does not verify the source IP and port, match the respons...

CVE-2026-119729

A flaw was found in GStreamer. An integer overflow vulnerability in the AV1 LEB128 variable-length integer parser allows a remote attacker to cause a crash in applications that process AV1 media content. By crafting a malformed AV1 bitstream containing an invalid LEB128-encoded value, an attacker...

CVE-2026-119728

A flaw was found in the H.264 video parser in gst-plugins-bad. When processing a specially crafted H.264 video file with malformed Multiview MVC Sequence Parameter Set data, the parser can dereference a NULL pointer during the cleanup of partially allocated internal structures after a parse...

CVE-2026-62264

PDF Reader MCP is a Model Context Protocol server for reading PDF documents. In versions 2.2.0 and later prior to 3.0.1, when "MCPTRANSPORT=http" enables the opt-in HTTP server, "@sylphx/pdf-reader-mcp" reads "MCPAPIKEY" and logs that "X-API-Key" authentication is enabled but never validates the...

CVE-2026-62162

Hydra is a layer-two scalability solution for Cardano. Prior to 2.1.0, the "Claim" branch in "hydra-plutus/validators/deposit.ak" checks only that "datum.headid" matches the attacker-controlled "redeemer.currencySymbol" and that the transaction is valid before the deposit deadline. It neither...

CVE-2026-62160

Daptin is a GraphQL/JSON-API headless CMS. Prior to 0.12.26, the global "LanguageMiddleware" in "server/language.go" passes the raw "Accept-Language" header from "LanguageMiddlewareFunc" through "GetLanguagePreference" to "golang.org/x/text/language.ParseAcceptLanguage" without a size or shape...

CVE-2026-61854

VoiceSentinel is a real-time voice moderation system for Minecraft servers. From 2.2.1 until 3.3.1, the optional report buffer feature has a race between retention cleanup and normal transcript writes. In "reportbuffer.py", "maybecleanup" uses an unlocked dictionary for once-per-hour cleanup...

CVE-2026-61840

Quest Bot is an opensource Discord Bot. Prior to 1.1.9, the "image to GIF" command uses a request helper that validates a hostname's public IP addresses but then sends the actual request by hostname, causing a "second DNS lookup". An attacker controlling a domain can return a public address durin...

CVE-2026-73322

Incorrect Authorization vulnerability in the single-stage query engine of Apache Pinot. When broker access control is enabled, the single-stage query engine authorizes only the table named in the query's FROM clause. The lookup transform function identifies its dimension table with a string liter...

CVE-2026-119117

Insertion of sensitive information into a log file in Amazon Kinesis Producer Library for Java before 1.0.8, when the library's logger is configured at DEBUG log level, might allow local users to obtain the AWS credentials that the library resolved for the application. Separately, affected versio...

CVE-2026-119777

A flaw was found in GStreamer's gst-plugins-bad H.266/VVC parser. When processing a malformed H.266 media file or stream, an integer overflow while parsing profile, tier, and level fields can lead to a stack-based buffer overflow. An attacker could cause an application to crash and may be able to...

CVE-2026-84243

The gettext family of functions in the GNU C Library version 2.0 and later accept LANGUAGE environment variable entries that contain '/' or that are equal to "..", unless the program is setuid or setgid ATSECURE. An attacker who can set LANGUAGE in the environment of a program that uses gettext c...

CVE-2026-119764

Mythic 3.2.16 through 3.4.0.61 contains a stored cross-site scripting vulnerability that allows attackers controlling target endpoint files to run JavaScript in the Mythic UI origin by planting HTML in .pdf-named files. When an operator downloads the file and clicks Preview Media, content-sniffed...

CVE-2026-119763

changelog.com before commit 7b35e829 contains a missing authorization vulnerability that allows unauthenticated attackers to read unpublished content via preview routes in PostController, NewsIssueController and NewsItemController. Attackers can enumerate hashid post IDs, sequential newsletter...

CVE-2026-119760

sniproxy through 0.7.0 contains a NULL pointer dereference vulnerability in resolvcancel that allows remote unauthenticated attackers to crash the daemon by sending overlong hostnames. Attackers can send a 254 or 255 character TLS SNI name or HTTP Host header matching a wildcard backend, then clo...

CVE-2026-61826

Bazarr is a companion application to Sonarr and Radarr. Prior to 1.5.7-beta.14, the "apinsplex" namespace in "bazarr/api/plex/oauth.py" omits "@authenticate" on its Resource handlers, while normal APIs require an API key and no global authentication hook compensates. Anonymous callers can invoke...

CVE-2026-50000

SecureDrop is an open-source whistleblower submission system that media organizations can use to securely accept documents from, and communicate with anonymous sources. From 2.5.0 until 2.16.0, the "Journalist Interface" can accept an "API session" token against the "web UI" because its...