CVE-2026-115904

Topluyo is a social networking platform. A vulnerability exists in Topluyo Desktop for Linux prior to version 2026.9.2410 where user-controlled URLs are unsafely processed, leading to OS Command Injection via the "openExternalLinks" routine in "utils.js". An attacker who controls a target URL can...

CVE-2026-93515

A use-after-free in presentclearwindownotifies in the X.org X Server before 21.1.25 and X Wayland before 24.1.14 could be used by malicious X clients to crash or potentially execute code in the X server context...

CVE-2026-114278

The che-machine-exec service constructs a shell command by concatenating user-controlled input the username and namespace fields from the /exec/init and /exec/config JSON endpoints into a double-quoted sh -c "echo "..." ..." invocation without any escaping. When che-machine-exec is run with...

CVE-2026-118485

Axel Download Accelerator 2.17.14 and earlier performs URL percent-decoding httpdecode on the output filename after the URL has been parsed and the filename component extracted. This allows an attacker to embed %2e%2e%2f URL-encoded ../ sequences in the URL path. These sequences survive the URL...

CVE-2026-101272

The mechanism binding files generated during a shredding process to the authentication method is not working correctly and the same session token is used for all token-based API users. This is similar to an issue fixed in 2026.7.1 but was missed while creating the fix. Since the files are referre...

CVE-2026-101274

When pretix is used as the identity provider in a Single-Sign-On SSO setup for customer accounts, the system did not properly validate the "responsetype" requested in an authorization request against the configured grant type of the SSO client. This means that if an SSO client was configured to...

CVE-2026-101273

Some of our API endpoints allowed to create order payments referencing a gift card by using the auto-incremented internal ID. This ID was not checked and allowed creating payments that reference gift cards from different organizers and thereby obtaining their secret. The gift card is not charged ...

CVE-2026-105457

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in HAVELSAN Inc. Liman MYS allows Path Traversal. This issue affects Liman MYS: before 2.3.5-1132...

CVE-2026-118435

Out-of-bounds write vulnerability in Samsung Open Source escargot allows Buffer Manipulation...

CVE-2026-115926

Summary free5GC's Binding Support Function BSF exposes all 13 SBI management endpoints at "/nbsf-management/v1" with zero authentication middleware. Unlike every other free5GC Network Function which uses "RouterAuthorizationCheck" middleware to validate OAuth2 Bearer tokens, the BSF's "AddService...

CVE-2026-115925

Executive Summary This audit identifies a critical security vulnerability where the free5gc project includes an unencrypted Root Certificate Authority CA private key committed directly to the source code repository. This exposes the entire PKI infrastructure and enables complete compromise of...

CVE-2026-115522

Exposure of Resource to Wrong Sphere CWE-668 in FileArtifactService in Google Agent Development Kit ADK for Python google-adk versions 1.19.0 before 1.39.1 and 2.0.0a1 before 2.7.0 allows a caller in one application to list, read, overwrite, or delete artifacts belonging to another application wh...

CVE-2026-118276

A vulnerability was determined in a2ui-project a2ui up to 0.10.6. This vulnerability affects the function formatString of the file renderers/webcore/src/v09/basiccatalog/expressions/expressionparser.ts of the component Parser. This manipulation causes resource consumption. The attack may be...

CVE-2026-118275

A vulnerability was found in a2ui-project a2ui up to 0.10.6. This affects the function DataContext.resolveSignal of the file renderers/webcore/src/v09/rendering/data-context.ts of the component Resolver. The manipulation results in resource consumption. The attack can be launched remotely. The...

CVE-2026-118274

A vulnerability has been found in a2ui-project a2ui up to 0.10.6. Affected by this issue is some unknown functionality of the file renderers/webcore/src/v09/rendering/generic-binder.ts of the component Binder. The manipulation leads to resource consumption. The attack can be initiated remotely. T...

CVE-2026-118273

A flaw has been found in a2ui-project a2ui up to 0.10.6. Affected by this vulnerability is the function DataModel.set of the file renderers/webcore/src/v09/state/data-model.ts. Executing a manipulation can lead to resource consumption. It is possible to launch the attack remotely. The exploit has...

CVE-2026-115624

GROWI contains a missing authorization check vulnerability in its collaborative editing feature. By exploiting this vulnerability, a user with read-only permission, including a guest user, or a user in pending, suspended, or invited status may modify page drafts...

CVE-2026-109848

GROWI contains an authorization bypass vulnerability in its tag update API and the page update API due to improper use of a user-controlled key. By exploiting this vulnerability, an attacker who can log in to the product may obtain the contents of pages without the required read permission and sa...

CVE-2026-105272

GROWI contains an authorization bypass vulnerability in its page viewing and commenting functionality due to improper use of a user-controlled key. By exploiting this vulnerability, an authenticated attacker may obtain the contents and comments of pages without the required read permission...

CVE-2026-118377

mews/pos through 2.0.0 contains an insufficient verification of data authenticity vulnerability that allows unauthenticated attackers to forge payment results by submitting unverified callbacks. GarantiPos, PayForPos and InterPos 3D Pay and 3D Host handlers skip check3DHash, letting attackers pos...

CVE-2026-118378

Tabularis before 0.28.0 contains an SQL injection vulnerability in its SQLite driver that allows MCP clients to execute stacked statements by supplying a crafted tablename to the describetable tool. Attackers, including AI agents steered by untrusted content, can close the quoted PRAGMA argument...

CVE-2026-118376

WeKnora before 0.8.2 contains a server-side request forgery vulnerability in isRestrictedIP that misclassifies NAT64-prefixed IPv6 addresses as public. Authenticated attackers can supply URLs resolving to NAT64 encodings of internal addresses via webfetch or URL-based knowledge import to reach...

CVE-2026-118375

llama.cpp b8841 before b11865 contains an out-of-bounds write vulnerability in the ggml-rpc RDMA transport rdmarecv function that allows unauthenticated peers to overflow the rpc-server stack. Attackers advertising RDMA capabilities in the HELLO message can send up to 256 KiB into a 1-byte stack...

CVE-2026-118374

LibreSSL ocspcheck through 4.4.0 contains a memory exhaustion vulnerability that allows malicious OCSP responders to exhaust memory by sending unbounded HTTP responses. Attackers controlling the responder or intercepting plain HTTP AIA OCSP traffic can stream endless headers or body data to...

CVE-2026-118373

LibreSSL ocspcheck through 4.4.0 contains a cleartext transmission vulnerability because url2host discards the OCSP URL scheme and httpalloc only selects TLS for port 443. On-path network attackers can read OCSP requests sent to https responder URLs on non-443 ports, exposing certificate serial...

CVE-2026-118372

LibreSSL ocspcheck through 4.4.0 contains a CRLF injection vulnerability that allows attackers to inject HTTP headers by embedding CR/LF sequences in a certificate's AIA OCSP URI path. Because url2host copies the path without rejecting control characters and httpopen places it in the POST request...

CVE-2026-118371

LibreSSL through 4.4.0 contains a CRLF injection vulnerability in the libcrypto OCSPsendreqnew and OCSPparseurl functions, which write unvalidated request paths into the OCSP POST request line. Attackers can embed carriage return and line feed characters in a certificate's Authority Information...

CVE-2026-118370

libexpat through 2.9.0 contains a signed integer overflow vulnerability in storeAtts in lib/xmlparse.c that allows attackers to trigger out-of-bounds writes via oversized attribute counts. Attackers can supply a multi-gigabyte document with a start tag carrying over 2^30 attributes to overflow...

CVE-2026-117609

rtl433 through 25.12 contains a stack-based buffer overflow vulnerability in proflame2mc that allows nearby attackers to write past a 7-byte stack buffer by sending more than seven valid Manchester-coded words. Attackers can transmit a crafted OOK radio signal or supply a crafted signal file to...

CVE-2026-117610

libexpat through 2.9.0 contains a NULL pointer dereference vulnerability in externalEntityInitProcessor2 in lib/xmlparse.c that mishandles the XMLTOKNONE token from empty input. Attackers who control stream chunking can force an empty non-final first parse on an external entity subparser, causing...

CVE-2026-117608

Assimp through 6.0.5 contains an integer overflow vulnerability in MD2Importer::ValidateHeader that allows attackers to bypass frame table bounds checks using crafted header fields. Attackers can supply a malicious .md2 file whose numFrames and numVertices values wrap the 32-bit size check, causi...

CVE-2026-117607

Xerte Online Toolkits through 3.15.5 contains a remote code execution vulnerability that allows authenticated users with system permission to run PHP by importing a crafted language pack. Attackers can upload a ZIP via importlanguage.php containing a .inc file, then request it through the languag...

CVE-2026-117606

NexoPOS through 6.3.0 contains a missing authorization vulnerability that allows authenticated cashiers to manipulate other cashiers' register sessions because CashRegistersService never compares usedby with the user. Attackers holding the default nexopos.use.registers permission can submit...

CVE-2026-117605

nopCommerce before 5.00.0 contains a missing authorization vulnerability in the admin ProductController RelatedProductAddPopup, CrossSellProductAddPopup and AssociatedProductAddPopup handlers that fail to verify parent product ownership. Authenticated vendors can submit another vendor's product i...

CVE-2026-118272

A vulnerability was detected in a2ui-project a2ui up to 0.10.6. Affected is the function DataContext.dispatchExpressionError of the file renderers/webcore/src/v09/rendering/data-context.ts of the component Error Handler. Performing a manipulation results in information exposure through error...

CVE-2026-118271

A security vulnerability has been detected in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the file renderers/webcore/src/v09/rendering/data-context.ts of the component data-context Resolver. Such manipulation leads to resource consumption. The attack may be performed from...

CVE-2026-110879

jackson-databind validates the outer class of a class-name type ID but accepts attacker-selected classes inside its generic arguments, even when those classes violate the declared type or would be rejected as direct type IDs. This bypasses the generic-argument validation added for CVE-2026-54512...

CVE-2026-110747

ProtobufParser.readStringKey reads the length prefix of a protobuf map entry's string key into an attacker-controlled int and then checks inputPtr + len = inputEnd using signed arithmetic. For values near Integer.MAXVALUE the addition overflows to a negative value and the check passes even when t...

CVE-2026-104895

The asynchronous Smile parser NonBlockingByteArrayParser uses a raw-binary length prefix taken from untrusted input to allocate a byte before the body is read, with no upper bound and no overflow check. On the raw-binary marker 0xFD, decodeVInt computes value 25 != 0 overflow guard present in the...

CVE-2026-106972

An uncontrolled recursion in the MessagePack\BufferUnpacker::unpack component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-106971

An integer overflow in the MessagePack\BufferUnpacker component of rybakit/msgpack v0.11.0 allows attackers to cause a Denial of Service DoS via a crafted input...

CVE-2026-104016

ProtobufParser parses length-prefixed protobuf string and bytes fields by checking inputPtr + len = inputEnd and then, on the fast path, calling finishShortTextlen. Both use 32-bit signed integer arithmetic. When an attacker supplies a varint decoding to a length near Integer.MAXVALUE, inputPtr +...

CVE-2026-118129

A vulnerability was found in jeremyckahn Chitchatter up to f82538633813c854a81a8b2112a2f6ba17b39cbc. The affected element is the function isConfigMessageEvent of the file src/Bootstrap.tsx of the component PostMessage Handler. Performing a manipulation of the argument parentDomain results in...

CVE-2026-59158

Nuxt Ollama integrates the official Ollama JavaScript library into Nuxt applications. Prior to 1.3.1, "src/module.ts" unconditionally merges all module options, including a configured cloud "apikey", into "runtimeConfig.public.ollama". Nuxt serializes this public configuration into the...

CVE-2026-58257

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, the database restoration feature fails to enforce or validate file paths. A user with administrator privileges can manipulate the input to read or delete arbitrary files on the server,...

CVE-2026-58256

GRR is a resource management and reservation application. Prior to the advisory-reported fixed version 4.5.0, an administrator can inject malicious PHP through LDAP connector configuration parameters such as "ldapfilter", poisoning "/personnalisation/configldap.inc.php" and permitting remote code...

CVE-2026-58255

Cronicle is a multi-server task scheduler and runner, with a web based front-end UI. Prior to 0.9.121, a non-administrator user or scoped API key with "createevents" and "runevents" privileges can inject top-level "uid" and "gid" fields through "/api/app/createevent" or "/api/app/updateevent". In...

CVE-2026-58205

GRR is a resource management and reservation application. Prior to version 4.5.0, "maj.php" reflects the "forcemaj" parameter without adequate escaping when installation files remain accessible. Removal of these files is not automatic. An attacker can craft a URL that executes arbitrary JavaScrip...

CVE-2026-58496

Thor Vector Graphics ThorVG is a production-ready vector graphics engine. Prior to 1.0.7, the "SFNT/TTF" font loader's "SfntLoader::gen" function in "tvgSfntLoader.cpp" reads "data0 through data3" to identify the font type without first checking that the input buffer contains at least four bytes...

CVE-2026-118128

A vulnerability has been found in a2aproject a2a-js up to 1.1.0. Impacted is the function ResultManager.applyStatusUpdate of the file src/server/resultmanager.ts of the component Task Status Update Handler. Such manipulation leads to race condition. The attack may be launched remotely. Upgrading ...