CVE-2026-93659

Concrete CMS Community Store before 2.7.8 renders customer-supplied order fields without HTML escaping in checkout and admin views. Unauthenticated attackers can store script payloads in billing name, email, or phone fields that execute in authenticated manager sessions to create rogue accounts o...

CVE-2026-93685

A flaw was found in the multicluster-observability-addon. A remote attacker can access a debug endpoint without authentication, due to a misconfiguration in the underlying addon-framework library. This allows for the disclosure of sensitive operational information, such as goroutine, heap, and...

CVE-2026-93660

SQLBot through 1.10.1 fails to verify dashboard ownership in updateresource and updatecanvas endpoints, allowing authenticated workspace members to modify other users' private dashboards. Attackers can supply arbitrary dashboard IDs to rename dashboards and overwrite component data, canvas styles...

CVE-2026-93652

Integer overflow in µD3TN v0.15.0 TCPCLv3 handshake causes heap overflow, allowing remote attackers to reliably cause DoS...

CVE-2026-93576

A flaw was found in Netty netty-codec-smtp. The component does not properly validate Carriage Return CR and Line Feed LF characters in the SMTP command-name field. A remote attacker, if an application routes untrusted input into this field, can embed CR/LF characters to inject arbitrary SMTP...

CVE-2026-93573

A flaw was found in Netty's HTTP/1.1 decoder. This vulnerability allows a remote attacker to bypass Transfer-Encoding header validation by splitting the Transfer-Encoding field across multiple headers, with the last field containing a non-final transfer coding like gzip or deflate. This bypass ca...

CVE-2026-93567

A flaw was found in Netty's HTTP/2 codec. When converting HTTP/1 CONNECT requests to HTTP/2, the component incorrectly uses the Host header instead of the CONNECT authority-form request-target for the tunnel authority. A remote attacker can exploit this by supplying a different Host header, leadi...

CVE-2026-93566

A flaw was found in Netty. A remote attacker could exploit this by sending a specially crafted HTTP request that includes control characters within the chunk-size line. This bypasses the intended strict validation, allowing the attacker to inject arbitrary HTTP requests. This vulnerability can le...

CVE-2026-93568

A flaw was found in Netty. A remote attacker could exploit this vulnerability by sending specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests. Netty's HTTP-object conversion path incorrectly processes these requests as regular HTTP/1.1 CONNECT requests, leading to a loss of critical...

CVE-2026-93565

A flaw was found in Netty RtspDecoder. The RtspMethods.valueOf function incorrectly strips trailing control bytes from method tokens in Real-Time Streaming Protocol RTSP requests. A remote attacker can exploit this by sending a specially crafted RTSP request, leading to method-token smuggling. Th...

CVE-2026-93569

A flaw was found in Netty. A remote unauthenticated attacker can exploit a vulnerability in Netty's HTTP/1 to HTTP/2 conversion process. When an HTTP/1 request includes both an absolute-form request-target and a conflicting Host header, Netty incorrectly prioritizes the Host header for the HTTP/2...

CVE-2026-93505

A vulnerability was found in SveltyCMS 0.0.6. This vulnerability affects unknown code of the file src/utils/media/media-service.server.ts of the component SVG Media Upload. Performing a manipulation results in cross site scripting. The attack can be initiated remotely. The patch is named...

CVE-2026-93564

A flaw was found in Netty. A reference-count leak in the HAProxy PROXY-v2 message decoder allows a remote, unauthenticated attacker to send specially crafted PROXY-protocol v2 headers. This can lead to memory exhaustion, resulting in a Denial of Service DoS for the affected system...

CVE-2026-93506

A vulnerability was determined in SveltyCMS 0.0.6. This issue affects some unknown processing of the file /mediagallery/upload-media of the component File Upload Endpoint. Executing a manipulation can lead to server-side request forgery. The attack can be launched remotely. This patch is called...

CVE-2026-93558

A flaw was found in Netty's WebSocketServerExtensionHandler. A remote, unauthenticated attacker can exploit this vulnerability by using HTTP/1.1 pipelining to send requests faster than the application can respond. This leads to an unbounded growth of a per-connection queue, consuming excessive...

CVE-2026-85511

A flaw was found in EAP's Elytron. An EAP application whose security domain is backed by an Elytron token-realm with oauth2-introspection would allow parameter substitution due to missing URL encoding...

CVE-2026-77928

ClipBucket v5 before 5.5.3-182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary database contents by submitting the msgid parameter as an array to bypass the cleanrequests sanitization function in ClipBucket.class.php. Attackers can pass unsanitize...

CVE-2026-77929

ClipBucket v5 before 5.5.3-182 contains a file upload vulnerability that allows authenticated users to achieve remote code execution by uploading a PHP file with valid image magic bytes through the photo upload endpoint. The FileUpload::manageFile function in fileupload.class.php fails to update...

CVE-2026-77927

ClipBucket v5 before 5.5.3-182 contains a blind SQL injection vulnerability that allows authenticated users to extract arbitrary data from the database by submitting the checkphoto parameter as an array to bypass the cleanrequests sanitization function in ClipBucket.class.php. Attackers can pass...

CVE-2026-25684

A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper evaluation of File Type Control policies in rare circumstances...

CVE-2026-16512

gptphandlemsg in subsys/net/l2/ethernet/gptp/gptp.c dereferenced the gPTP header returned by GPTPHDR and switched on hdr-messagetype without first checking that the received frame carries at least sizeofstruct gptphdr 34 bytes of payload. The header accessor gptpgethdr deliberately never fails fo...

CVE-2026-16514

gptpmiqualifyannounce in subsys/net/l2/ethernet/gptp/gptpmi.c walks the Path Trace TLV of a received IEEE 802.1AS Announce message, comparing each clock identity against the local one. The loop bound was taken solely from the attacker-controlled wire field announce-stepsremoved accepted up to 254...

CVE-2026-16515

neticmpv6senderror in subsys/net/ip/icmpv6.c implemented only one of the three RFC 4443 section 2.4 suppression rules do not answer an ICMPv6 error with an ICMPv6 error. It did not check whether the triggering packet's source address identifies a single node rule e.6 or whether the packet was sen...

CVE-2026-10832

A flaw was found in the DERDecoder class within wildfly-elytron-asn1. A remote attacker can exploit this resource exhaustion vulnerability by sending a specially crafted DER Distinguished Encoding Rules payload. The decoder attempts to allocate excessive memory based on an inflated length value...

CVE-2025-1350

IBM Controller 11.0.0 through 11.0.1 FP7, and 11.1.0 through 11.1.3 FP1 could allow a remote attacker to obtain sensitive information when a detailed technical error message is returned in the browser. This information could be used in further attacks against the system...

CVE-2025-13882

IBM Sterling Partner Engagement Manager Essentials Edition 6.3.0.0 through 6.3.0.2, and 6.2.4.0 through 6.2.4.4 and IBM Sterling Partner Engagement Manager Standard Edition 6.2.4.0 through 6.2.4.4 could allow an unauthenticated user to cause a denial of service in the email service due to imprope...

CVE-2024-56344

IBM Cognos Analytics 12.0.4 through 12.0.4 FP2, and 12.1.0 through 12.1.3 FP1 could allow a remote attacker to obtain sensitive information, caused by the failure to properly enable HTTP Strict Transport Security. An attacker could exploit this vulnerability to obtain sensitive information using...

CVE-2026-93606

vm2 npm versions 3.12.0 and earlier contain a sandbox escape in VM and NodeVM. When an embedder exposes a host API that returns a host-realm Promise, the bridge's rejection sanitizer hostPromiseSanitizeReject / makeSanitizedPromiseCallback / normalizeHostPromiseCallbacks in lib/bridge.js only wra...

CVE-2026-93605

vm2 NodeVM versions before 3.12.1 contain a sandbox escape vulnerability where the DANGEROUSBUILTINS denylist omits childprocess despite blocking other host-spawning modules. Attackers can require childprocess and execute arbitrary commands on the host system when NodeVM is configured with...

CVE-2026-93604

vm2 through 3.12.0 exposes Node.js's crypto.setFips function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM require.builtin: 'crypto'. The builtin sanitizer sanitizeCryptoModule in lib/builtin.js replaces crypto.setEngine but leaves crypto.setFips...

CVE-2026-93603

vm2 through 3.12.0 fixed in 3.12.1 does not correctly handle a nullish this receiver in the apply trap of its bridge lib/bridge.js: when sandboxed code calls a host-provided non-strict sloppy-mode function without a receiver — e.g. fn, a detached method, fn.call, fn.applyundefined, Reflect.applyf...

CVE-2026-93600

rustls-webpki rustls/webpki versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced. Because name constraints are restrictions on otherwise properly issu...

CVE-2026-93601

rustls-webpki the Rust webpki fork used by rustls versions = 0.101.0 and prior to 0.103.12 and 0.104.0-alpha.6 incorrectly accepted permitted-subtree DNS name constraints for certificates asserting a wildcard name. For example, a name constraint of accept.example.com was treated as satisfied by a...

CVE-2026-93597

ArcadeDB versions before 26.9.1 fail to validate IPv6 transition addresses in the SSRF guard used by IMPORT DATABASE and server commands. Authenticated attackers can supply URLs resolving to NAT64, 6to4, or Teredo addresses embedding RFC 1918 or loopback IPv4 payloads to reach internal services a...

CVE-2026-93598

ArcadeDB Maven artifact com.arcadedb:arcadedb-engine through 26.8.1 contains an incomplete deny-list in the polyglot script sandbox: com.arcadedb.query.polyglot.HostClassLookupFilter.DENIED lists java.util.ResourceBundle as a bare class name, which is matched by exact equality and therefore does...

CVE-2026-93602

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints. Attackers with a compromised trusted issuing authority can...

CVE-2026-93599

rustls-webpki through 0.103.12 and 0.104.0-alpha releases before 0.104.0-alpha.7 contains a reachable panic in bitstringflags in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly 0x00 zero padding bits and no data bytes, so rawbits.len - 1 underflows on t...

CVE-2026-93594

ArcadeDB Maven artifact com.arcadedb:arcadedb-engine through 26.8.1 enforces its per-type/per-record access-control rules only in LocalBucket, keyed on file id. Query-execution paths that reach record data through LSM index files or the TimeSeries engine never invoke that permission check, so an...

CVE-2026-93595

ArcadeDB before 26.9.1 contains an access control bypass vulnerability in the querydatabase tool exposed through the AI chat endpoints. The tool executes queries without binding the authenticated principal to DatabaseContext, causing per-type and per-bucket ACL checks to silently no-op and allowi...

CVE-2026-93592

vLLM versions before 0.28.0 fail to validate the lower bound of token IDs in the /v1/embeddings and /pooling endpoints, allowing unauthenticated attackers to crash the engine by submitting negative token IDs. A single request with a negative token ID triggers a CUDA device-side assertion that...

CVE-2026-93596

ArcadeDB before 26.9.1 com.arcadedb:arcadedb-engine outedges/inedges buckets, resulting in unauthorized modification of graph adjacency. Setting parallelFlush=false causes the request to be correctly rejected. This is an incomplete fix of GHSA-c23x-pqcj-7hfm, which bound the principal only on the...

CVE-2026-93593

ArcadeDB before 26.9.1 fails to enforce security-group types ACL entries for TimeSeries types because the ACL resolver builds permissions from bucket IDs, but TimeSeries types do not own normal record buckets. An authenticated low-privilege user can read or insert TimeSeries samples despite...

CVE-2026-93591

SiYuan versions before 3.8.3 contain an SQL injection vulnerability in the graph.go query2Stmt function where tag values are concatenated raw into SQL string literals without escaping single quotes. A publish-mode reader or anonymous visitor can inject SQL via inline HTML span tags in the getGrap...

CVE-2026-93588

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a NULL pointer dereference in the PNM coder. When the coder reaches a memory resource limit at a specific point during processing, the failed allocation is not handled and a NULL pointer is dereferenced, which can lead to a denial of servi...

CVE-2026-93589

ImageMagick before 7.1.2-31 and 6.9.13-56 contains a division-by-zero flaw in the FLIF encoder. An incorrect value for ticks per second in the image being encoded causes a divide-by-zero and crashes the encoder, resulting in a denial of service. The issue is fixed in 7.1.2-31 and 6.9.13-56...

CVE-2026-93586

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a use-after-free vulnerability in the ImagesToBlob method, caused by a pointer that is not updated correctly. Exploitation may result in a limited availability impact e.g., a crash of the affected process. The issue is fixed in versions...

CVE-2026-93587

ImageMagick before 7.1.2-31 and before 6.9.13-56 contains a policy bypass in the PCD and, per the upstream advisory, CUBE and HALD coder: when a specific command line option is supplied, the decoder does not check a configured resource limit, which can result in extra memory allocation. A local...

CVE-2026-93590

ImageMagick before 7.1.2-31 contains a policy bypass vulnerability in the UHDR encoder that fails to perform policy checks during buffer allocation for image pixels. Attackers can bypass resource policies by processing specially crafted UHDR images, potentially causing denial of service through...

CVE-2026-93504

A vulnerability has been found in SveltyCMS 0.0.6. This affects an unknown part of the file src/routes/api/...path/+server.ts of the component User Attribute Update Endpoint. Such manipulation leads to improper access controls. It is possible to launch the attack remotely. The name of the patch i...

CVE-2026-93560

A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integer value. This integer truncation vulnerability could lead to an infinite decode loop, causing a Denial of Service DoS by exhausting memo...