CVE-2026-118774

Forge also called node-forge is a native implementation of Transport Layer Security in JavaScript. Prior to 1.4.1, the affected implementation used certificate.verifychild, verifySignature, lib/x509.js to process the relevant input or security decision. node-forge selected RSA padding and...

CVE-2026-118773

Glob matches files using patterns the shell uses. From 9.0.0 until 14.0.2, abort branches in src/walker.ts, including GlobUtil.walkCB, GlobUtil.walkCB2, GlobUtil.walkCBSync, and GlobUtil.walkCB2Sync, invoke the callbacks without returning. After AbortSignal or AbortSignal.timeout rejects or emits...

CVE-2026-41216

An invalid pointer dereference vulnerability exists in the vtkPNGReader::ExecuteInformation functionality of vtk 9.6. A specially crafted .png file can lead to a denial of service. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2026-42057

An invalid pointer dereference vulnerability exists in the vtkPNGReader::vtkPNGReaderUpdate2 functionality of vtk 9.6. A specially crafted .png file can lead to a denial of service. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2026-8822

A memory corruption vulnerability exists in the vtkDEMReader ReadProfiles functionality of vtk versions: 9.6.1. A specially crafted USGS DEM can lead to a buffer overflow. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2026-9535

A out-of-bounds read vulnerability exists in the vtkChacoReader InputGraph2 functionality of vtk versions: 9.6.1. A specially crafted chaco can lead to an out-of-bounds read. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2026-8824

A memory corruption vulnerability exists in the vtkBMPReader ExecuteDataWithInformation functionality of vtk versions: 9.6.1. A specially crafted .bmp file can lead to a buffer overflow. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2026-9536

A heap-based buffer overflow vulnerability exists in the vtkWindBladeReader FindVariableOffsets functionality of vtk versions: 9.6.1. A specially crafted .wind can lead to a buffer overflow. An attacker can provide a malicious file to trigger this vulnerability...

CVE-2026-118772

joi is a schema description language and data validator for JavaScript. From 17.1.1 until 17.13.9 and 18.3.1, the Joi.string.email multiple: true rule uses a separator regular expression whose leading whitespace quantifier is retried at every position in a long whitespace run that contains no...

CVE-2026-119168

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during same-client allocation data migration that may allow a malicious workload to change permissions and ownership of host directories. This could allow unauthorized access to host data or modification of host files,...

CVE-2026-107347

HashiCorp Nomad and Nomad Enterprise are vulnerable to symlink following during dispatch payload and executor log writes that may allow a malicious workload to modify files outside its allocation directory. When the client agent runs as root, this could lead to code execution as root on the clien...

CVE-2026-102260

HashiCorp Nomad and Nomad Enterprise are vulnerable to cross-namespace authorization bypasses in several read-only API endpoints that may allow an authenticated user with read permissions in one namespace to view information about objects in other namespaces. This vulnerability CVE-2026-102260 is...

CVE-2026-116566

socket.getaddrinfo previously accepted null bytes within host and port parameters which can cause the values to be silently truncated...

CVE-2026-118769

Botan is a C++ cryptography library. From 2.1.0 until 3.13.0, the Botan C API function botanblockcipherblocksize converted a sizet block size to int without a bounds check. In an application that accepts external algorithm parameter strings and uses the FFI raw ECB mode, an attacker can select th...

CVE-2026-118768

Botan is a C++ cryptography library. From 1.11.34 until 3.13.0, the botan ocspcheck command requested an OCSP response from a certificate's Authority Information Access URL without verifying the response signature or authorizing the signer. A malicious responder or on-path attacker could return a...

CVE-2026-118767

Botan is a C++ cryptography library. From 1.11.22 until 3.13.0, Botan's Python binding converted Python strings containing U+0000 to const char values without consistently rejecting the embedded NUL, causing bcrypt and checkbcrypt to process only the prefix before the NUL. Applications could...

CVE-2026-118766

Botan is a C++ cryptography library. Prior to 3.13.0, Botan's online OCSP client allowed a single HTTP redirect while posting an OCSP request to the URI in a certificate's Authority Information Access extension. A malicious OCSP responder or an on-path attacker could redirect the client to make o...

CVE-2026-118765

Botan is a C++ cryptography library. From 3.7.0 until 3.13.0, an application that calls AutoSeededRNG::clear and then calls randomize with an empty output buffer while the generator is unseeded can cause AutoSeededRNG to mark itself seeded without consulting the configured entropy source. On buil...

CVE-2026-118764

minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to 11.0.1, src/index.ts implements firstPhasePreProcess so that, at optimizationLevel 2 or higher, it repeatedly expands attacker-controlled /.. pattern segments inside a fixpoint loop,...

CVE-2026-118763

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 0.7.2, packages/oci/src/registry.ts contains a RegistryClient.signIn method that stores registry Authorization and Docker configuration headers as defaults on a shared HTTP client, while...

CVE-2026-11587

SQL injection allowing an authenticated user with access to ACL management to read and modify the Centreon database...

CVE-2026-118761

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server decompressed uploaded pipeline archives without adequately bounding expanded data while locating or reading the pipeline file. A small ZIP or gzip-compressed tar...

CVE-2026-119115

Incorrect authorization in the issuer resolution logic in AWS Private CA Connector for Kubernetes aws-privateca-issuer before v1.10.1 might allow an authenticated remote user to obtain certificates, including subordinate CA certificates, signed by a cluster-scoped AWS Private CA issuer that their...

CVE-2026-118760

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 0.5.1 until 2.17.0, the frontend artifact routes did not check whether an authenticated user was authorized to access the requested namespace. A user who can reach the frontend and knows an...

CVE-2026-118759

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server's GET /apis/v1alpha1/runs/runid/nodes/nodeid/log handler retrieved logs without authorizing the caller against the selected run. A caller who can reach the backend a...

CVE-2025-12523

Broken Object Level Authorization in Users Configuration Endpoint allows Information Disclosure to authenticated user...

CVE-2026-62374

SD JWT JS is a JavaScript implementation of the Selective Disclosure JWT SD-JWT specification. In version 0.19.0 and earlier, "@sd-jwt/decode", also used by "@sd-jwt/core", silently drops a tampered Disclosure whose digest no longer matches the Issuer-signed "sd" array and returns a reduced claim...

CVE-2026-118758

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the volume artifact handler for GET /artifacts/get?source=volume did not confine a caller-supplied file path to the selected volume. A caller who can reach the route and identify a...

CVE-2026-118673

KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. From 2.3.0 until 2.8.0, KeePassXC browser integration encrypts authorized responses in src/browser/BrowserMessageBuilder.cpp using a fixed 1 MiB output vector even though...

CVE-2025-13050

Broken Function Level Authorization allows execution of poller post-restart commands by authenticated user...

CVE-2026-119145

Frappe before 15.121.0 and 16.x before 16.34.0 contains a path traversal vulnerability because certain file-upload handling does not validate the destination path before writing to disk. Authenticated attackers can upload crafted files to locations outside the intended storage directory to achiev...

CVE-2026-119144

Frappe Framework before 15.111.0 and 16.x before 16.21.0 contains a server-side template injection vulnerability because user-controlled message fields are rendered as templates without neutralization. An authenticated attacker holding a common operational role can inject template expressions tha...

CVE-2026-119142

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability where dropping the Future returned by TypedFunc::callasync can panic the host. When the guest task has not started, cleanup code searches only one location for work items and unwraps the resulting...

CVE-2026-119143

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows guest code to trigger a host panic through out-of-bounds zero-length stream operations. Malicious guests can perform zero-length component model stream reads or writes with unvalidated...

CVE-2026-119141

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious Wasm modules to panic the host because the mayleave flag is not cleared during realloc. Attackers can call into the host from realloc while lowering stream or future results, su...

CVE-2026-119140

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows malicious components to panic the host via thread.yield in start functions. Attackers can supply a component whose start function calls an async-lowered import then thread.yield, causing ...

CVE-2026-119139

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a leftover assertion in component::Func::call that rejects guest exports using the async ABI option. An attacker who supplies a component with an async-lifted export can crash the host process when an embedder invokes that export...

CVE-2026-119138

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability that allows pending calls to trigger an assertion failure after a trap poisons the Store. Attackers supplying misbehaving guest code can cause a trap and let earlier calls proceed, crashing embedders...

CVE-2026-119137

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a stack overflow vulnerability that allows guests to crash the host through recursive type drops. Guests can define a long chain of recursive types so that removing the top-level type triggers unbounded recursive drops, exhausting th...

CVE-2026-119136

Wasmtime 42.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains insufficient checks in Store when mixing async-style and sync-style WebAssembly calls. Embedders re-entering WebAssembly via sync APIs from host functions called asynchronously can trigger runtime panics or unsound cross-thread...

CVE-2026-119135

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 panics when the host reads a component model stream as a different Rust item type than it was created with, because the host-to-host read path asserts matching TypeIds instead of returning an error. Guest code can return a host-created...

CVE-2026-119134

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 caps component-model resource handle tables only per component instance and does not charge handle allocations to any ResourceLimiter or StoreLimits. A malicious guest can repeatedly call resource.new and instantiate...

CVE-2026-119133

Wasmtime 47.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a memory misalignment flaw in VMContext layout that causes undefined behavior when modules contain an odd number of exception tags. A WebAssembly module with an odd tag count misaligns subsequent host fields in embedders with...

CVE-2026-119132

Wasmtime from 49.0.0 before 49.0.3 contains a denial-of-service vulnerability that allows a WebAssembly guest to trigger a host panic by transcoding overlapping strings in fused adapters. Attackers can make a same-instance component-to-component call transferring a string whose source and...

CVE-2026-119130

Wasmtime before 36.0.18, 37.0.0 before 48.0.6, and 49.0.0 before 49.0.3 does not verify that set-path-with-query values in wasmtime-wasi-http are paths, so absolute-form URLs are written verbatim as the HTTP/1.1 request target while the connection uses the allowed authority. A malicious guest can...

CVE-2026-119131

Wasmtime 46.0.0 before 48.0.6 and 49.0.0 before 49.0.3 contains a denial of service vulnerability in wasmtime-wasi-http that lets guests crash the host by sending long request URLs. Guests can use set-path-with-query with a '?' after byte 65535, overflowing a u16 index in the http crate and...

CVE-2026-119129

ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that allows attackers to approve OAuth 2.0 device authorizations using a victim's existing session without consent. Attackers can send a signed-in user a link carrying the attacker's us...

CVE-2026-119128

ZITADEL 4.0.0 before 4.19.5 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to set the first credential of users lacking any authentication method. Attackers can compute a valid verificationCheck cookie from the user ID and browser...

CVE-2026-119127

ZITADEL 4.0.0 before 4.19.5 contains a host header injection vulnerability in the Login V2 UI that allows unauthenticated attackers to poison password-reset, invite, and email-verification links by supplying untrusted x-zitadel-public-host, x-zitadel-forward-host, or x-forwarded-host headers...

CVE-2026-119126

Parse Server before 8.6.106 and 9.0.0 before 9.10.5-alpha.7 mishandles dot notation keys with null or undefined values when building the saved object, so a write is stored but returns an error and skips afterSave triggers and LiveQuery events. A client with write access can exploit this to evade...