CVE-2026-113440

Insufficiently Protected Credentials vulnerability in hackney in benoitc hackney allows a redirecting server to obtain the basicauth and cookie credentials of a request via a same-host redirect to another scheme or port. With followredirect enabled, hackney:followredirect/10 in src/hackney.erl...

CVE-2026-115700

Interpretation Conflict vulnerability in hackneyurl in benoitc hackney allows Server Side Request Forgery via a percent-encoded bracketed IPv6 literal or an IP literal with a trailing dot. A host such as %5B%3A%3Affff%3A127%2E0%2E0%2E1%5D decoding to ::ffff:127.0.0.1 or 127.0.0.1. is not an IP...

CVE-2026-112880

Improper Neutralization of CRLF Sequences in HTTP Headers 'HTTP Request/Response Splitting' vulnerability in hackneyhttpconnect in benoitc hackney allows HTTP Request Splitting via the value a proxyauthfun callback returns. After a 407 response from an HTTP CONNECT proxy,...

CVE-2026-111590

A wide range of Harbor versions allow SSRF via its webhook delivery component which does not properly validate web hook target addresses, allowing usage of private and link-local IP ranges. An authenticated attacker with ProjectAdmin permissions can configure a webhook policy pointing to a privat...

CVE-2026-108529

Inefficient Algorithmic Complexity vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server CPU via small SETTINGS or connection-level WINDOWUPDATE frames. The attacker opens thousands of streams whose responses block on the connecti...

CVE-2026-110499

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to grow per-connection memory and CPU cost without bound via a large SETTINGSHEADERTABLESIZE. Bandit resizes its HPACK encoder table to...

CVE-2026-109584

Improper Handling of Highly Compressed Data Data Amplification vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a small HPACK-compressed HEADERS block. The block stores one large cookie value in the HPACK dynamic...

CVE-2026-111103

Improper Cleanup on Thrown Exception vulnerability in the HTTP/2 handler of mtrudel bandit allows an unauthenticated remote attacker to bypass per-connection resource limits via a single TCP write that carries several frames, one of which raises a stream error. When a frame raises StreamError...

CVE-2026-111101

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory and CPU via a request body made of many 1-byte chunks. The chunked reader in lib/bandit/http1/socket.ex keeps...

CVE-2026-113436

Inefficient Algorithmic Complexity vulnerability in the header integer parser of mtrudel bandit allows an unauthenticated remote attacker to consume server CPU via a content-length value or a Host or :authority port made of thousands of digits. Bandit.Headers.parseinteger/2 in lib/bandit/headers....

CVE-2026-110314

Client-Side Enforcement of Server-Side Security vulnerability in the WebSocket connection handling of mtrudel bandit allows a remote client to keep running WebSock handler code after the server has stopped its connection, via data frames sent after ignoring the server's Close frame. When a WebSoc...

CVE-2026-114213

Allocation of Resources Without Limits or Throttling vulnerability in the WebSocket fragment reassembly of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via a fragmented message made of many 1-byte continuation frames. Bandit.WebSocket.Connection checks...

CVE-2026-114216

Inconsistent Interpretation of HTTP Requests 'HTTP Request/Response Smuggling' vulnerability in the HTTP/1.1 chunked body reader of mtrudel bandit allows an unauthenticated remote attacker to smuggle a second request past a front-end proxy via a chunk extension that contains a bare LF. The chunke...

CVE-2026-115269

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 request body reader of mtrudel bandit allows an unauthenticated remote attacker to hold stream processes open indefinitely via WINDOWUPDATE or empty SETTINGS frames sent while a Plug reads the request body...

CVE-2026-108525

Allocation of Resources Without Limits or Throttling vulnerability in the HTTP/2 implementation of mtrudel bandit allows an unauthenticated remote attacker to exhaust server memory via DATA frames sent past the advertised receive window. The attacker requests a response larger than the 65,535-byt...

MSC-2026-13090

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Contacting external host – this package sends...

MSC-2026-13089

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

MSC-2026-13091

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Code injection testing – an attacker checks if...

CVE-2026-116488

NXP MCUXpresso SDK USB middleware mcuxsdk-middleware-usb before 2.13.0 contains a heap buffer overflow in host audio, video and CDC class drivers that trust device-supplied bNumEndpoints and bLength values. A malicious USB device can supply crafted descriptors that write endpoint entries past the...

CVE-2026-116487

NXP MCUXpresso SDK USB middleware mcuxsdk-middleware-usb before 2.13.0 contains an out-of-bounds read vulnerability in USBDeviceCdcRndisSetCommand that trusts a host-supplied informationBufferOffset. A malicious USB host can send RNDIS SET messages for OIDGENCURRENTPACKETFILTER or...

CVE-2026-116486

Objenesis before 3.6 contains a type confusion vulnerability that allows code in one class loader to substitute objects into another by exploiting instantiator caching keyed on class name. When a shared ObjenesisStd instance caches instantiators by clazz.getName in ObjenesisBase.getInstantiatorOf...

CVE-2026-116485

danmuapi before 1.21.7 contains an authentication bypass vulnerability that allows unauthenticated attackers to modify server environment configuration when the default TOKEN is used and ADMINTOKEN is unset. Attackers can send POST requests to /api/env/set, /api/env/add, or /api/env/del to set...

CVE-2026-116219

Dolibarr ERP CRM before 24.0.0 contains an OS command injection vulnerability in htdocs/admin/tools/export.php that lets authenticated administrators bypass the restrictoscommands allowlist. Attackers can submit a mysqldump value chaining commands with & characters around an allowlisted basename ...

CVE-2026-116217

RosarioSIS before 12.9.2 contains a reflected cross-site scripting vulnerability in modules/FoodService/MenuReports.php that allows unauthenticated attackers to inject attributes via unescaped menuid and modname parameters. Attackers can lure a logged-in administrator to a crafted Modules.php lin...

CVE-2026-116218

Dolibarr ERP CRM 19.0.0 before 23.0.4 contains an SQL injection vulnerability that allows authenticated API users to inject SQL via the type field of the third-party bankaccounts REST endpoint. Attackers with only societe/creer permission can break out of the unescaped type value in...

CVE-2026-116214

MacCMS v10 before 2026.1000.4054 contains an authentication bypass vulnerability that allows unauthenticated attackers to reset any member's password because checkmsg never compares msgto. Attackers can request a recovery code to their own mailbox via user/findpassmsg, then submit it to...

CVE-2026-116213

Webasyst Framework through 4.4.0 contains an arbitrary file read vulnerability in waArchiveTar::writeItem that creates symlinks from theme archives without validating link targets. Authenticated users with theme management rights can upload themes containing symlinks to wa-config/db.php or...

CVE-2026-116212

Webasyst Framework through 4.4.0 contains a stored cross-site scripting vulnerability in the Photos app that allows authenticated backend users to inject JavaScript via the album url parameter. Attackers with album edit rights can save a url value that breaks out of the unescaped attribute in...

CVE-2026-116210

Webasyst Framework through 4.4.0 contains a cross-site request forgery vulnerability in the Photos app that allows remote attackers to perform backend actions because the app does not enable the framework's opt-in CSRF check. Attackers can lure logged-in Photos users to a malicious page that...

CVE-2026-107157

Specially crafted CBOR input passed to QCborValue::fromCbor in Qt Core can cause an out-of-bounds read, which may crash the application and could expose information...

CVE-2026-115196

An Open Redirect vulnerability exists in the public form submission endpoint /form/submit of Mautic. After a form is submitted, the application redirects the visitor to a return address supplied with the submission without verifying that it points to the Mautic instance or another trusted host. A...

CVE-2026-115195

A broken access control vulnerability exists in the Mautic Stats API /api/stats/table. The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables without an explicit permission mapping were readable by default. As...

CVE-2026-115194

A path traversal vulnerability exists in the Mautic Asset API. When creating a local asset through the API, the supplied file path is not restricted to the asset upload directory. An authenticated API user with permission to create assets can register any file that is readable by the web server...

CVE-2026-115193

A stored Cross-Site Scripting XSS vulnerability exists in the contact detail view of Mautic 7. Values of HTML-type custom contact fields are rendered without output sanitization. A user or integration able to write a value to such a field for example, through contact editing, the contact API, or ...

CVE-2026-115192

An SQL Injection vulnerability exists in the dashboard widget data API endpoint /api/data/type. Chart filter parameters supplied by the client are not properly validated before they are used in the database queries that build dashboard chart data. An authenticated user with API access can exploit...

CVE-2026-115191

A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface /s/ajax. A request parameter that selects the contact field to search by is not properly validated before it is used in a database query. Any authenticated Mautic user can exploit this,...

CVE-2026-115190

An insecure deserialization PHP object injection vulnerability exists in Mautic's handling of segment filters and custom field properties. Several code paths that read these stored values from the database deserialize them without restricting which PHP classes may be instantiated, instead of usin...

CVE-2026-115189

A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic. The sandbox introduced to restrict user-uploaded theme templates the fix for GHSA-9fx4-7cmj-47vg does not fully enforce its restrictions, allowing a crafted theme template to escape the sandbox. A...

CVE-2026-115188

An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user...

CVE-2026-116275

A vulnerability was found in AllenAI AllenNLP up to 2.10.1. This impacts the function Registrable.resolveclassname of the file allennlp/common/registrable.py of the component Registrable Configuration Machinery. Performing a manipulation of the argument Type results in code injection. The attack...

CVE-2026-116492

Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the getcontactbyphonenumber API, which performs raw database queries without invoking the permission...

CVE-2026-115720

Frappe Builder before 1.36.1 contains a server-side request forgery vulnerability in builder/api.py where the assertnotprivateurl guard validates only the initial hostname before callers invoke requests.geturl with default redirect-following and no IP pinning, allowing an attacker-supplied public...

CVE-2026-116263

A flaw has been found in HaschekSolutions PictShare up to 3.7.1. The impacted element is the function architect of the file src/inc/core.php of the component File Upload. This manipulation causes race condition. The attack can be initiated remotely. The attack's complexity is rated as high. The...

MSC-2026-13073

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Remote reverse shell – this package enables acces...

MSC-2026-13086

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Remote reverse shell – this package enables acces...

MSC-2026-13072

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Remote reverse shell – this package enables acces...

MSC-2026-13079

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: • Code injection testing – an attacker checks if...

MSC-2026-13076

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: This package contained malicious code and was...

MSC-2026-13084

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Contacting external host – this package sends...

MSC-2026-13088

This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running user's machine or backend server. The following risks were identified: Code injection testing – an attacker checks if...