CVE-2026-79976

The MCTP-over-I2C+GPIO target binding in subsys/pmci/mctp/mctpi2cgpiotarget.c emulates a small pseudo-register file, where the bus controller first writes a register number and then writes or reads payload bytes. The selected register b-regaddr and the data-phase flag b-rxtx were never cleared wh...

CVE-2026-78116

The Broadcom AFBR-S50 time-of-flight sensor driver double-completes an RTIO submission when sensor data evaluation fails. In datareadyworkhandler drivers/sensor/broadcom/afbrs50/afbrs50.c, a non-STATUSOK return from ArgusEvaluateData calls handleerroronresult, which finalises the request with...

CVE-2026-78117

The Infineon PSOC 6 BLESS HCI driver in drivers/bluetooth/hci/hciinfineonpsoc6bless.c stored the outgoing HCI packet descriptor in a file-scope variable, static cystcblehcitxpacketinfot hcitxpkt. psoc6blesssend cleared and populated that descriptor's packetType, dataLength and data fields before...

CVE-2026-78119

The Nuvoton NPCX eSPI driver parses Target-Attached-Flash TAF requests in espitafparse drivers/espi/espinpcx.c, taking the 12-bit length field directly out of the request header in the FLASHRXBUF FIFO. For write and RPMC OP1 requests it copied DIVROUNDUPlen, 4 words into struct espitafpckt.src, a...

CVE-2026-78118

The kernel helper zwaitqhead kernel/include/waitq.h reads the head of a thread wait queue, but on SMP systems it was called from several places without holding the scheduler spinlock schedspinlock that serializes wait-queue mutation. The consequential call site is ztimerexpirationhandler in...

CVE-2026-18748

The Bluetooth Classic A2DP host stores a codec Information Element IE in struct bta2dpcodecie, a one-byte len field plus a fixed 8-byte codecie array. When an AVDTP peer sent a codec IE longer than 8 bytes, a2dpprocessconfigind in subsys/bluetooth/host/classic/a2dp.c copied only the first 8 bytes...

CVE-2026-19676

The user-mode verifier for the pecitransfer system call, zvrfypecitransfer in drivers/peci/pecihandlers.c, checked only the device object permission and copied the caller-supplied struct pecimsg with kusermodefromcopy. That copy validates the outer structure only; the buf pointers and len values...

CVE-2026-19947

The device multiplexer pseudo-driver in drivers/misc/devmux/devmux.c exposes two system calls, devmuxselectget and devmuxselectset. When CONFIGUSERSPACE is enabled, their user-mode verifiers zvrfydevmuxselectget and zvrfydevmuxselectset forwarded directly to the kernel implementations without...

CVE-2026-114268

A flaw has been found in Tenda BE3L Pro 16.03.60.62. Affected by this vulnerability is the function formWifiBasicSet of the file /goform/WifiBasicSet. This manipulation of the argument security5g causes buffer overflow. It is possible to initiate the attack remotely. The exploit has been publishe...

CVE-2026-114361

A vulnerability was detected in HarnessRouter up to 0.31.10. This affects an unknown function of the file gateway/app.py of the component Identity Mode. Performing a manipulation of the argument X-Harness-Org/X-Harness-Member results in improper authorization. The attack is possible to be carried...

CVE-2026-113870

MongoDB Compass improperly escapes certain BSON values when converting a stored view’s aggregation pipeline into editable source. When a user connects to a MongoDB deployment containing a specially crafted view and opens that view for editing, the values can cause arbitrary code to execute with t...

CVE-2026-114266

A security vulnerability has been detected in ProjectWorlds Advanced Library Management System 1.0. This impacts the function mysqliquery of the file profile.php. The manipulation of the argument adminid leads to sql injection. The attack is possible to be carried out remotely. The exploit has be...

CVE-2026-114267

A vulnerability was detected in SourceCodester Food Order Management System 1.0. Affected is an unknown function of the component Admin Endpoint. The manipulation results in missing authorization. The attack may be performed from remote. The exploit is now public and may be used...

CVE-2026-111804

Apache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric IDs to the internal stats API. This issue affects Apache Traffic Server: from 10.0.0 through 10.1.4, 10.2.0. Users are recommended to upgrade to...

CVE-2026-111816

Apache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked carve-out bypassed the rejection path. A response that two peers can read differently is then stored and served, allowing cache poisoning and...

CVE-2026-113461

Local privilege escalation in Checkmk 2.5.0p14 allows a local user with write access to the Oracle client library directory of an Oracle home listed in the 'oratab' file or to the 'oratab' file itself to execute code as root if an agent has the 'mk-oracle' plugin enabled...

CVE-2026-111813

Apache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default unsigned configuration. This issue affects Apache Traffic Server: from 8.0.1 through 8.1.11, from 9.0.0 through 9.2.15, from 10.0.0 through 10.1.4, 10.2.0. Users...

CVE-2026-110803

VaadinService.requestEnd in Vaadin Framework 8 locks the session and then reads the v-uiId request parameter outside the block that releases the lock. A request carrying a non-numeric v-uiId makes Integer.parseInt throw while the session lock is held, so the lock is never released and the contain...

CVE-2026-111401

Cross-Site Request Forgery CSRF vulnerability in Tailored Media Tailored Tools tailored-tools allows Cross Site Request Forgery.This issue affects Tailored Tools: from n/a through 3.0.3...

CVE-2026-105942

When a configured proxy role sends a request to the broker on behalf of another user the original principal, the broker is designed to authorize both the proxy role and the original principal and to allow the request only if both are authorized, so that the original principal cannot exceed its ow...

CVE-2026-105944

Apache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user accounts and login, and it can be configured with an HTTP authentication credential, such as a token, that it uses to call the Pulsar admin API on behalf of its users. Pulsar Manager has the...

CVE-2026-105945

The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by using the filesystem storage provider. Package names consist of a type, tenant, namespace, name and version. Authorization of package operations is based only on the tenant and...

CVE-2026-107588

Vaadin Charts renders charts with the Highcharts library and pins an exact version of it, 9.2.2 in Vaadin 22 to 24 and 12.2.0 in Vaadin 25, so an application cannot remove these vulnerabilities by upgrading Highcharts on its own. Highsoft disclosed several vulnerabilities in that library that are...

CVE-2026-105935

The Pulsar Functions Worker provides a REST API endpoint for triggering a function, which publishes a caller-supplied value to one of the function's configured input topics. The Functions Worker performs this publish with its own broker client, which authenticates with the Worker's configured...

CVE-2026-105936

The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on the functions worker: the worker connectors endpoint /admin/v2/worker/connectors and the deprecated functions connectors endpoint /admin/v2/functions/connectors and...

CVE-2026-105937

Apache Pulsar shadow topics PIP-180 are topics that read the stored messages of a source topic from that topic's managed ledger. The source topic is selected by setting the reserved topic property PULSAR.SHADOWSOURCE. The admin REST API accepts this property when creating a non-partitioned or...

CVE-2026-105938

Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription authentication mode, which requires a subscription name to start with the role name, or by granting permission on a subscription to specific roles. Topic-level subscription operations, su...

CVE-2026-105934

The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics DELETE /admin/v2/persistent/tenant/namespace/topic/truncate. Truncating a topic moves all subscription cursors of the topic to the end of the topic and deletes the topic's inactive ledgers. Truncating a...

CVE-2026-105931

The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactions. When authentication and authorization are enabled, most of the read endpoints of this API verify only that the request is authenticated and that the broker serves the requested topic or transactio...

CVE-2026-105932

The Apache Pulsar broker admin REST API provides endpoints to read, set and remove the topic-level entry filter policy of a topic. For persistent topics these endpoints check that the caller is authorized for the entry filters topic policy operation. The corresponding endpoints for non-persistent...

CVE-2026-105933

Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a namespace by setting the encryptionrequired namespace policy. When this policy is set, the broker rejects messages that are published without encryption. When the broker loads a persistent topic, it...

CVE-2025-55702

When a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body left on the client connection as the next request. An attacker behind a front-end proxy that shares connections to Traffic Server can use this to smugg...

CVE-2025-31699

Apache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but never fully sent, including when the client used Expect: 100-continue. The origin then reads a later request on that connection as leftover body dat...

CVE-2026-92209

NoMachine Redis Improper Authentication Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of NoMachine. An attacker must first obtain the ability to execute low-privileged code on the target system in order to...

CVE-2026-92210

NoMachine nxhtd Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The specific flaw exists...

CVE-2026-92205

BusyBox libarchive Symlink Directory Traversal Arbitrary File Creation Vulnerability. This vulnerability allows remote attackers to create arbitrary files on affected installations of BusyBox. User interaction is required to exploit this vulnerability in that the target must visit a malicious pag...

CVE-2026-92207

MindsDB OpenBBtable Code Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of MindsDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the OpenBBtable class. The...

CVE-2026-92208

NoMachine mDNS Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NoMachine. Authentication is not required to exploit this vulnerability. The specific flaw exists within the...

CVE-2026-92206

CrewAI crewAI Framework Agent Loading Unsafe Reflection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of CrewAI crewAI. User interaction is required to exploit this vulnerability in that the target must load a...

CVE-2026-89035

MikroTik RouterOS through 7.24.5 contains a session token replay vulnerability in the WebFig interface that allows attackers to bypass authentication by replaying captured session tokens across new ECDH sessions. The makeSessionKey function in libucrypto.so generates tokens using fixed salts...

CVE-2026-92204

Airbyte OneDrive Connector getshareddriveobject Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability. T...

CVE-2026-92183

GIMP APNG File Parsing Stack-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of GIMP. User interaction is required to exploit this vulnerability in that the target must visit a malicious page...

CVE-2026-92202

Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is required to exploit this vulnerability in that the target mus...

CVE-2026-92203

Airbyte SharePoint Connector getshareddriveobject Server-Side Request Forgery Information Disclosure Vulnerability. This vulnerability allows remote attackers to initiate arbitrary server-side requests on affected installations of Airbyte. Authentication is required to exploit this vulnerability...

CVE-2026-114493

LocalAI v4.6.0 through v4.11.0 contains a server-side request forgery vulnerability in core/gallery/gallery.go that validates only the initial gallery config URL. Attackers can submit a config URL through POST /models/apply that redirects to internal or cloud metadata addresses, receiving those...

CVE-2026-114265

A weakness has been identified in ProjectWorlds Advanced Library Management System 1.0. This affects the function mysqliquery of the file returnedbooksearch.php of the component Search Form. Executing a manipulation of the argument datefrom/dateto can lead to sql injection. The attack can be...

CVE-2026-114491

pdfmake 0.3.8 before 0.3.12 fails to apply the setLocalAccessPolicy restriction to images referenced inside SVG content, allowing attackers to read blocked local files. Attackers supplying a document definition can add an SVG image href pointing to a local path, embedding restricted file contents...

CVE-2026-114492

gin-vue-admin through 2.9.2 contains a path traversal vulnerability that allows authenticated administrators to recursively delete arbitrary directories by supplying traversal sequences in the pluginName parameter. Attackers can send a crafted POST request to /autoCode/removePlugin with '../'...

CVE-2026-114264

A security flaw has been discovered in ProjectWorlds Advanced Library Management System 1.0. The impacted element is an unknown function of the file editmember.php. Performing a manipulation of the argument firstname/middlename/lastname/address/branch/type results in sql injection. Remote...

CVE-2026-114262

A vulnerability was determined in file-management-system dc9ce1bf27f94b23d906cb1e86ce374dc94ca5df. Impacted is the function store of the file app/Http/Controllers/FileController.php. This manipulation of the argument File causes unrestricted upload. The attack may be initiated remotely. The explo...