CVE-2026-16491

Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an administrator of every folder. This could expose deleted...

CVE-2026-116676

Atlantis is a self-hosted golang application that listens for Terraform pull request events via webhooks. From version 0.4.0 until 0.47.1, Atlantis passes the pull-request-controlled workspace value from atlantis.yaml into Terraform command arguments that are joined with strings.Joinargs, " " and...

CVE-2026-57189

Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a "T.140 RED" out-of-bounds write during "generation accumulation" using carefully crafted packets, potentially allowing remote code execution or causing Asterisk...

CVE-2026-57201

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, a stack buffer overflow in the H.323 "ooTrace" trace-logging function can occur when unbounded "vsprintf" writes into a fix...

CVE-2026-114598

In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents...

CVE-2026-57194

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an out-of-bounds write in "chanunistim" "DIALPAGE" digit handling can overflow the "phonenumber" field and crash Asterisk...

CVE-2026-114597

In EPICS Base release 7.0.10 and prior, an insufficient validation of element or length values in a network message can cause the application to read beyond the bounds of an allocated buffer. This may lead to denial of service and could expose adjacent memory contents...

CVE-2026-114596

In EPICS Base release 7.0.10 and prior, an improper validation of message length values during protocol parsing can trigger an integer overflow, resulting in an out-of-bounds memory write. Successful exploitation can cause process instability or denial of service...

CVE-2026-114595

In EPICS Base release 7.0.10 and prior, an integer overflow in network request processing can cause memory to be allocated with an incorrect size. Subsequent handling of attacker supplied data may result in memory corruption, denial of service, or potential remote code execution...

CVE-2026-57198

Asterisk is an open source private branch exchange and telephony toolkit. In affected deployments, an authenticated attacker may cause a "T.140 RED" heap buffer overflow using carefully crafted packets, potentially allowing remote code execution or causing Asterisk to crash. The "chansip" channel...

CVE-2026-116675

TinyMCE is an open source rich text editor. From 7.9.3 until 7.9.4 and from 8.5.1 until 8.9.3, the media plugin creates elements crafted through data-mce-object in the active document before sanitization. Those elements can execute malicious scripts during processing, resulting in stored cross-si...

CVE-2026-116674

systeminformation is a System and OS information library for node.js. Prior to 5.33.13, networkStatsifaces in lib/network.js on FreeBSD, OpenBSD, and NetBSD stores per-interface data in the plain-object network cache and indexes it with the sanitized caller-controlled interface name. Passing prot...

CVE-2026-57185

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an authenticated attacker may crash Asterisk through a buffer over-read in the "PJSIP MWI body parser" by sending a careful...

CVE-2026-116673

systeminformation is a System and OS information library for node.js. Prior to 5.33.14, the Linux networkStatsiface implementation uses the caller-supplied interface value in an fs.existsSync check and to build /sys/class/net/ paths, including the operstate path, without verifying that it is a...

CVE-2026-57197

Asterisk is an open source private branch exchange and telephony toolkit. Prior to Asterisk 20.20.1, 21.12.3, 22.10.1, 23.4.1 and Certified Asterisk 20.7-cert11, 22.8-cert3, an unbounded "memcpy" of "OGG/Speex" packet data in "formatoggspeex" can cause a heap buffer overflow and crash Asterisk wh...

CVE-2026-109090

A malicious X server could cause a heap overflow by injecting a large DEVICEENABLE reply when processed by libXi before 1.8.4...

CVE-2026-116672

Authlib is a Python library which builds OAuth and OpenID Connect servers. From 0.15 until 1.9.1, the documented ClientConfigurationEndpoint.authenticateclient and ClientConfigurationEndpoint.checkpermission reference implementations look up a target client from request-controlled clientid data a...

CVE-2026-109088

A malicious X server could send malformed RECORD EnableContext reolies that can cause a X client using the parsereplycallcallback function in libXtst before 1.2.6 to enter a endless loop...

CVE-2026-77167

Abusing the federated share endpoint, an attacker can write arbitrary rows into the ocshareexternal database table. These rows persist indefinitely — there is no automatic cleanup mechanism. Three distinct denial-of-service conditions follow from this write primitive, all triggered from the same...

CVE-2026-87897

A SSRF vulnerability found that enables access to internal Chrome Devtools Protocol APIs that can leak the JWT authentication token for another user. A low privileged attacker could continually exploit this vulnerability to leak the JWT authentication token for another user when they start a...

CVE-2026-82984

When a team was configured as "visible to everyone", the web UI correctly blocked non-members from viewing the team "You are not a member of ...", but the resources API endpoint could still be called directly, allowing any authenticated non-member to enumerate the team's internal resources and...

CVE-2026-77171

A public shared collective always allowed recipients of the link to create pages...

CVE-2026-82983

The Tables app's share-listing endpoint GET /apps/tables/share/table/tableId did not verify that the requesting user has manage-level permission on the table before returning the full list of share recipients users, groups, and teams along with their permission levels. A user who was only granted...

CVE-2026-77172

App passwords were allowed to bypass password confirmation on sensitive endpoints...

CVE-2026-67400

A missing token type check allowed to retrieve more additional information about the WOPI configuration with a user or guest token...

CVE-2026-82986

The user in a group can bypass the group restriction set by an administrator on link sharing, creating share links for a table even though they shouldn't have that permission...

CVE-2026-77173

A user could create a docx or odt file with a in the filename with confidential information such as a credit card number and have it not be marked as confidential...

CVE-2026-54462

Knative pkg provides common packages shared across Knative repositories. Prior to 0.0.0-20260531000007-52dbd5ece63f, the knative.dev/pkg/webhook admissionHandler in webhook/admission.go decodes an attacker-supplied AdmissionReview through json.NewDecoderio.TeeReaderr.Body, &bodyBuffer under an...

CVE-2026-109089

A buffer overflow when handling DEVICERESOLUTION in libXi before 1.8.4 could overflow a heap, triggered by a malicious X server...

CVE-2026-117511

A vulnerability has been found in desmondmorris node-tesseract up to 0.2.7. Affected by this issue is the function process of the file lib/tesseract.js of the component Command Builder. Such manipulation of the argument image leads to os command injection. The attack can be executed remotely. The...

CVE-2026-109823

An attacker can read the name of filesystem paths of your application present via Tidewave configuration via /tidewave/connect or via the rendered toolbar. Neither response checks the Host header. A web page that rebinds its own domain to the loopback address can therefore read the tag with a...

CVE-2026-117510

A flaw has been found in Dexmal Dexbotic up to 0.2.0. Affected by this vulnerability is the function loadpretrainedgr00t of the file dexbotic/model/gr00tsonic/gr00tsonicarch.py of the component gr00tsonic Checkpoint Loader. This manipulation of the argument weightmap causes path traversal. Remote...

CVE-2026-104189

The 3D Viewer for Nextcloud is a comprehensive 3D model viewer application for Nextcloud that supports multiple 3D file formats. In versions 1.7.9 through 3.3.1, the app's public file endpoint performed no share authorization. Anyone who knows a share token could read the shared file's contents...

CVE-2026-117507

A security vulnerability has been detected in a2aproject a2a-java up to 1.2.0.Final. This impacts the function TaskManager.saveTaskEvent. The manipulation leads to race condition. The attack may be initiated remotely. Upgrading to version 1.3.0.Final will fix this issue. The identifier of the pat...

CVE-2026-34157

Wails v2 provides "BindingsAllowedOrigins" to restrict which web origins can invoke Go backend methods via IPC. The wildcard pattern matching in "wildcardPatternToRegex" converts "" to "." without anchoring subcomponents, allowing suffix-matched origins to bypass the restriction. An attacker who...

CVE-2026-46350

dcmjs, a JavaScript library for DICOM manipulation used in web-based medical imaging viewers, contains an input validation bypass in its handling of DS Decimal String and IS Integer String value representations. The DecimalString and IntegerString classes in ValueRepresentation.js use a regex...

CVE-2026-117506

A weakness has been identified in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setInfo of the file...

CVE-2026-117604

Grav from 1.7.53.3 before 1.7.53.6 contains an authorization bypass in Debugger::isDebuggerRequestAuthorized that allows unauthenticated visitors to read /clockwork/ profiler data via a loopback REMOTEADDR fallback. Behind a same-host reverse proxy, remote requests appear as loopback, letting...

CVE-2026-117505

A security flaw has been discovered in a2aproject a2a-java up to 1.2.0.Final. The impacted element is the function queue.offer of the component ChildQueue. Performing a manipulation results in resource consumption. The attack can be initiated remotely. Upgrading to version 1.3.0.Final is sufficie...

CVE-2026-117504

A vulnerability was identified in a2aproject a2a-go up to 2.4.0. The affected element is the function Cancel of the file internal/taskexec/distributedmanager.go of the component Distributed Manager. Such manipulation leads to denial of service. It is possible to launch the attack remotely...

CVE-2026-117503

A vulnerability was determined in a2aproject a2a-go up to 2.4.0. Impacted is an unknown function of the file a2asrv/rest.go of the component REST SSE handler. This manipulation causes resource consumption. It is possible to initiate the attack remotely. Upgrading to version 2.5.0 is recommended t...

CVE-2026-117603

Electrum before 4.7.2 contains a spending limit bypass vulnerability in the Nostr Wallet Connect plugin that allows malicious NWC clients to exceed dailylimitsat by exploiting non-atomic budget checks and millisatoshi truncation. Attackers can send concurrent payinvoice requests that pass...

CVE-2026-117602

Electrum 4.6.0 before 4.7.2 contains an authorization bypass in the external plugin loader, which executes a plugin's init.py module when the plugin is marked enabled in the config file, without verifying its plugin-password signature. A rogue local process with write access to the Electrum data...

CVE-2026-117601

Electrum before 4.8.3 fails to verify signatures of wallet-owned inputs in unconfirmed mempool transactions, allowing malicious servers to replace a just-broadcast transaction with a conflicting one. Attackers can swallow the user's transaction and display an invalid zero-fee copy paying an...

CVE-2026-117573

hagent through commit 761eec6 contains an OS command injection vulnerability that allows MCP clients to execute shell commands by injecting metacharacters into the args parameter of the hagentarduino and hagentesp32 tools. Attackers or prompt-injected agents can supply crafted args interpolated...

CVE-2026-117570

Vorota-ai nmap-mcp through commit 3636afa contains an improper allowlist validation vulnerability in the scanvulnerabilities tool that lets callers run blocked NSE script categories. MCP clients or prompt-injected agents can pass categories like exploit, dos, brute, or intrusive to nmap --script,...

CVE-2026-117569

Kali-GPT through commit a608c74 contains an OS command injection vulnerability in executetool in kaligpt/tools/mcpserver.py that allows MCP clients to run commands via unsanitized scanner parameters. Attackers or prompt-injected agents can embed shell metacharacters in parameters like target,...

CVE-2026-117566

EasyImages2.0 through 2.8.6 contains an unauthenticated path traversal vulnerability in app/down.php, app/thumb.php and app/info.php that allows reading files outside the upload directory. Attackers can supply ../ sequences in the dw, history or img parameters to read files with allowed upload...

CVE-2026-117565

Artalk before 2.10.1 contains an unauthenticated server-side request forgery vulnerability that allows remote attackers to make the server fetch arbitrary URLs by submitting anonymous comments to /api/v2/comments. Attackers can set a pagekey to an internal URL, which GetTitleByURL fetches after...

CVE-2026-117564

nest-admin before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge administrator tokens by using a hardcoded JWTSECRET committed in .env.production. Attackers can sign tokens with the known secret that JwtStrategy and RbacGuard trust,...