CVE-2026-74766 Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decode_punycode

Net::IDN::Punycode versions from 2.301 before 2.590 for Perl allow a heap use-after-free via a decoded code point that reallocates the output buffer in decodepunycode. The XS backend inserts each decoded code point into the string buffer of the scalar it returns. decodepunycode computes the...

CVE-2026-93710 Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compile_hooks

Dancer2 versions from 2.0.0 before 2.2.0 for Perl dispatch a route that a dying hook refused when the exception handler halts the response in compilehooks. A hook that dies fires core.app.hookexception, then calls cleanup unless the failing hook is the exception handler. A handler that halts does...

CVE-2026-59815 Joplin: Pending share recipients can write items into shared folders before accepting invitations

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.7, Joplin Server's ItemModel.checkIfAllowed authorizes writes to items with a share ID when any shareusers row exists for the caller, without requiring ShareUserStatus.Accepted. ...

CVE-2026-79919 MaxKB function-library sandbox escape: dlopen stack-check bypass via importlib meta-path callbacks and unhooked dlsym(RTLD_NEXT)

MaxKB is an open-source AI assistant for enterprise. Prior to version 2.10.6-lts, function-library code running under the LDPRELOAD sandbox can invoke ctypes.CDLL from an importlib.abc.MetaPathFinder callback so the dlopen call-stack heuristic sees a Python import frame, then use unhooked dlsym...

CVE-2026-94496 jshERP through 3.6 Privilege Escalation via Role Management

jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to all data, and...

CVE-2026-55473 HomeBox: Notifier SSRF guard misses NAT64 prefixes (64:ff9b::/96, 64:ff9b:1::/48) — generic:// URL reaches cloud metadata on NAT64 egress

HomeBox is a home inventory and organization system. Prior to 0.26.0, the default-on BlockBogonNets and BlockCloudMetadata notifier SSRF protections in backend/internal/sys/validate/notifierurl.go do not inspect IPv4 destinations embedded in the NAT64 prefixes 64:ff9b::/96 and 64:ff9b:1::/48. An...

CVE-2026-61628 nginx ignition has Unauthenticated Admin Account Creation via Onboarding Race Condition

nginx ignition is a user interface for the nginx web server. Prior to version 2.41.1, POST /api/users/onboarding/finish is registered as anonymous unauthenticated and creates a user with full ReadWrite admin permissions. Because the handler uses a check-then-act TOCTOU pattern between the...

CVE-2026-86473 Apache Airflow: Logout ignores a presented Authorization bearer token, leaving it revocable only by expiry

Apache Airflow: the Core API logout endpoint revokes only a session token presented as the token cookie. When a client logs out presenting its credential as an Authorization bearer header instead, the endpoint returns its normal logout response but revokes nothing, so the token remains valid unti...

CVE-2026-92612

In Eclipse iceoryx2 versions greater than v0.8.0, the StaticString exposes its contents as mutable bytes through safe APIs, while String::asstr converts those bytes into a Rust string slice without validating UTF-8. An application can therefore create an invalid &str and trigger undefined behavio...

CVE-2026-94143 drogonframework drogon ORM Mapper Mapper.h orderBy sql injection

A vulnerability was detected in drogonframework drogon up to 1.9.13. Affected by this issue is the function Mapper::orderBy in the library Mapper.h of the component ORM Mapper. Performing a manipulation of the argument sort results in sql injection. The attack is possible to be carried out...

CVE-2026-93969 aiyiyi121 SxDevOps services.py ensure_default_superuser hard-coded credentials

A vulnerability was identified in aiyiyi121 SxDevOps 1.0/1.1. This vulnerability affects the function ensuredefaultsuperuser of the file rbac/services.py. The manipulation leads to hard-coded credentials. The attack is possible to be carried out remotely. The identifier of the patch is...

CVE-2026-93988 QloApps through 1.7.0 Arbitrary File Read via getEmailHTML

QloApps through 1.7.0 contains a path traversal vulnerability in the getEmailHTML action of admin/ajax.php that allows authenticated back-office users to read arbitrary files. Attackers can supply relative path sequences in the email parameter to bypass directory restrictions and access sensitive...

CVE-2026-93955 grimmory-tools grimmory Download Endpoint KoboController.java streamFileToResponse authorization

A vulnerability was detected in grimmory-tools grimmory up to 3.3.3/3.4.1. Affected by this vulnerability is the function streamFileToResponse of the file backend/src/main/java/org/booklore/controller/KoboController.java of the component Download Endpoint. Performing a manipulation of the argumen...

CVE-2026-78030 DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbm_type and dbm_mldbm attributes in DBD::DBM

DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbmtype and dbmmldbm attributes in DBD::DBM. DBD::DBM passes the dbmtype and dbmmldbm connect attributes to require without checking that the value names a module. require treats a path-shaped string as a literal filename a...

CVE-2026-71855 Suricata flow: IPv4/IPv6 hash collision can reuse wrong flow state

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, src/flow-hash.c can treat an IPv4 and IPv6 flow as equal without comparing the IP family when their raw address words, ports, protocol, VLAN, recursion...

CVE-2026-57223 Suricata windows: unquoted LocalSystem service ImagePath can allow local privilege escalation

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the Windows service installation and parameter-update logic in src/win32-service.c can pass an unquoted service ImagePath to CreateServiceA. When Surica...

CVE-2026-63448 Suricata smb: some SMB flows can cause resource exhaustion

Suricata is a network Intrusion Detection System, Intrusion Prevention System and Network Security Monitoring engine. Prior to 7.0.17 and 8.0.6, the SMB parser can retain force-completed transactions on flows where Suricata sees payload in only one direction, including async-oneside flows, becaus...

CVE-2026-76899 CordysCRM: Authenticated SQL injection via `sort.name` on `POST /account-pool/page`

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. From 1.7.0 until 1.7.4, POST /account-pool/page allows an authenticated caller with MODULESETTINGUPDATE to place an arbitrary database function in SortRequest.name because...

CVE-2026-76900 CordysCRM: SSRF via Approval Flow Webhook Execution due to Missing SSRF Validation at Runtime

CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. In version 1.7.3, ApprovalResourceService.sendWebHook reads WebHookConfig.webHookUrl from stored approval-node configuration and passes it through...

CVE-2026-93872 Cotonti 1.0.0 PHP Object Injection via Comments Plugin Edit Action cb Parameter

Cotonti 1.0.0 passes the base64-decoded cb parameter to unserialize without allowedclasses restriction in the comments plugin EditAction. Registered users with comment write permissions can instantiate arbitrary PHP objects and potentially achieve file write or code execution through gadget chain...

CVE-2026-93759 Server-side JavaScript injection via string query criteria bypassing the strict operator allowlist

Mongoid does not neutralize a string-typed query criterion supplied to its query builder, and instead passes it to the database as a server-side JavaScript expression. An unauthenticated party able to influence the value an application supplies as a query argument may cause code of their choosing...

CVE-2026-93762 Data deletion and attribute disclosure via field-name method injection in in-memory queries

Mongoid contains an unsafe reflection weakness in the query path used for embedded documents. An application that passes an externally supplied field name to certain in-memory query methods may allow an unauthenticated party to obtain unintended disclosure of stored document data and to permanent...

CVE-2026-33625 LMDeploy vulnerable to arbitrary code execution via eval() of untrusted quant_dtype in model config loading

LMDeploy is a toolkit for compressing, deploying, and serving large language models. Versions 012.1 through 0.12.2 contain a code injection vulnerability in lmdeploy/pytorch/config.py line 620 that allows an attacker to execute arbitrary Python code by publishing a malicious HuggingFace model wit...

CVE-2026-63349 AnyIO run_process/open_process ignores extra_groups and can retain parent supplementary groups

AnyIO is a high level asynchronous concurrency and networking framework that works on top of either Trio or asyncio. In 4.14.0, AnyIO accepts the POSIX extragroups argument in anyio.runprocess and anyio.openprocess, but openprocess forwards the group argument to the backend instead of extragroups...

CVE-2026-61833 zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion

zot is a container image and artifact registry based on the Open Container Initiative Distribution Specification. Prior to 2.1.18, the bearer authentication handler in pkg/api/authn.go maps every HTTP method other than GET and HEAD to the push action, so DELETE requests are not checked for the...

CVE-2026-77610 Semantic MediaWiki has a query debug output XSS (`DebugFormatter`)

Semantic MediaWiki is a free, open-source extension to MediaWiki that lets users store and query data within the wiki's pages. Prior to version 7.2.0, query debug output format=debug, or the debug request parameter on Special:Ask is assembled by SMW\Query\DebugFormatter and emitted as raw HTML...

CVE-2026-93533 spatie Scotty Doctor DoctorCommand.php checkRemoteTools os command injection

A vulnerability was determined in spatie Scotty up to 1.4.4. This impacts the function DoctorCommand::checkSshConnectivity/DoctorCommand::checkRemoteTools of the file app/Commands/DoctorCommand.php of the component Doctor Command Handler. This manipulation of the argument host causes os command...

CVE-2026-54147 http4k: `DigestAuthProvider.verify` ignored configured algorithm and did not bind to request URI

http4k is a functional toolkit for Kotlin HTTP applications. Prior to 4.51.0.0, 5.42.0.0, and 6.50.0.0, DigestAuthProvider.verify in http4k-security-digest ignores its configured algorithm parameter and verifies every Digest response with hardcoded MD5. Deployments configured for SHA-256 therefor...

CVE-2026-63635 OpenImageIO: PSD RawColor invalid color mode causes global out-of-bounds read and allocation DoS

OpenImageIO is a toolset for reading, writing, and manipulating image files of any image file format relevant to VFX / animation. Prior to 3.0.21.0, 3.1.16.0, and 3.2.0.3-beta1, A crafted psd with an invalid colormode bypasses normal validation when oiio:rawcolor or psd:rawdata is enabled...

CVE-2026-93019 Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tga_palette_read

Imager versions before 1.036 for Perl exit the process reading a TGA with a colour map length of 32768 or more in tgapaletteread. The reader unpacks the two-byte colour map length into a signed short, so a length of 32768 or more becomes negative. tgapaletteread casts that value to sizet and asks...

CVE-2026-93604 vm2 3.11.8 Sandbox Escape via crypto.setFips

vm2 through 3.12.0 exposes Node.js's crypto.setFips function to untrusted guest code when an embedder explicitly allowlists the crypto builtin for a NodeVM require.builtin: 'crypto'. The builtin sanitizer sanitizeCryptoModule in lib/builtin.js replaces crypto.setEngine but leaves crypto.setFips...

CVE-2026-93602 rustls-webpki before 0.103.10 CRL Revocation Check Bypass

rustls-webpki versions before 0.103.10 and 0.104.0-alpha.5 contain faulty CRL authority-matching logic that compares only the first distributionPoint against each CRL's IssuingDistributionPoint, ignoring additional distributionPoints. Attackers with a compromised trusted issuing authority can...

CVE-2026-93599 rustls-webpki before 0.103.13 Panic via empty BIT STRING

rustls-webpki through 0.103.12 and 0.104.0-alpha releases before 0.104.0-alpha.7 contains a reachable panic in bitstringflags in src/der.rs. The input guard fails to reject a named-bit BIT STRING whose content is exactly 0x00 zero padding bits and no data bytes, so rawbits.len - 1 underflows on t...

CVE-2026-54644 CubeCart: XSS via Anchor Tag Attribute Injection in gui.class.php Message System

CubeCart is an ecommerce software solution. Prior to 6.7.5, the errorMessage method in classes/gui.class.php uses striptags to permit anchor elements in error, information, and warning messages while retaining unsafe href values and onclick event handlers. Attacker-controlled search or input data...

CVE-2026-54608 MythicalDash: Unauthenticated payment bypass in Stripe success-redirect endpoint allows arbitrary free credit top-up

MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/System/Gateways/Stripe.php creates a pending row in mythicaldashstripepayments before Stripe checkout succeeds and embeds the payment code in the success redirect, while GET...

CVE-2026-53556 SQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File Read

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend/apps/datasource/crud/datasource.py incorporates the client-controlled tablename value into generated SQL without safe identifier handling...

CVE-2026-77615 Paella Player: Stored XSS via caption cue text

Paella Player is a set of libraries to create a multi stream video player. Prior to Paella Player 2.12.11 as used in Opencast prior to 19.7 and 20.2, there is a potential XSS attack though closed captions cue text. This vulnerability is fixed in 2.12.11...

CVE-2026-93395 Integer Underflow → Heap Out-of-Bounds Read in `bson_new_from_buffer()

A missing lower-bound validation in the bsonnewfrombuffer function of libbson allows an integer underflow when processing BSON data with a zero-length prefix. The function reads a 32-bit document length from the input buffer but does not verify that the value is at least 5 the minimum valid BSON...

CVE-2026-54237 Wavelog: Unauthenticated Remote Code Execution

Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interfaceassets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches writeconfig and writeconfigfile in...

CVE-2026-50285 Pomerium: Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback

Pomerium is an identity and context-aware access proxy. Prior to 0.32.8, decodeQueryStringV2 in pkg/hpke/url.go performs zstd decompression of attacker-controlled data without an output-memory limit when DecryptURLValues processes HPKE V2 values for Stateless.Callback in...

CVE-2026-92993 Dromara mayfly-go Machine Script Feature machine_script.go RunMachineScript os command injection

A vulnerability was detected in Dromara mayfly-go up to 1.11.5. The impacted element is the function RunMachineScript of the file server/internal/machine/api/machinescript.go of the component Machine Script Feature. The manipulation of the argument params results in os command injection. The atta...

CVE-2026-92992 Dromara mayfly-go AI Assistant ai.go authorization

A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. The affected element is an unknown function of the file server/internal/ai/api/ai.go of the component AI Assistant. The manipulation leads to missing authorization. Remote exploitation of the attack is possible. The...

CVE-2026-55062 uniget: Path Traversal in Hook Files - Directory Escape Vulnerability

uniget is a universal installer and updater for container tools. Prior to 0.27.6, the hooks edit command in cmd/uniget/hooks.go concatenates an unvalidated hook filename with the selected hooks directory, allowing parent-directory components to escape that directory. The resulting path is passed ...

CVE-2026-52727 lxc-ci: Pacman keyring stored in archlinux image with a private key

lxc-ci contains continuous integration and image-build scripts for LXC. Prior to the 2026-05-28 Arch Linux image publication, images built from images/archlinux.yaml retain the same pacman local-signing private key in /etc/pacman.d/gnupg and redistribute it to every container or virtual machine...

CVE-2026-54676 Scoold: GET /api/posts/{id}/answers leaks private-space replies when personal API tokens are enabled

Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve replies from questions in private spaces they cannot access because src/main/java/com/erudika/scoold/api/ApiController.java in ApiController.getPostReplies does not apply...

CVE-2026-54446 NetLicensing MCP Server: Unauthenticated Use of Server-Side NetLicensing API Key in HTTP Mode

NetLicensing MCP Server is a natural-language interface that enables agentic applications to manage the software-licensing lifecycle in Labs64 NetLicensing. Prior to 0.1.6, network-reachable HTTP transport requests to /mcp that omit x-netlicensing-api-key, Authorization: Bearer, and the apikey...

CVE-2026-54582 mport package installation can overwrite existing unmanaged or differently owned files

mport is the MidnightBSD Package Manager. Prior to 2.7.8, package installation lacked a preflight check for incoming non-directory assets that already existed on disk. The affected logic across libmport/checkpreconditions.c, libmport/installprimative.c, and libmport/mportprivate.h did not apply...

CVE-2026-93197 memcg: move LRU size accounting on reparenting instead of copying it

In the Linux kernel, the following vulnerability has been resolved: memcg: move LRU size accounting on reparenting instead of copying it When a memory cgroup is offlined its LRU folios are reparented to the parent. lruvecreparentlru splices the child's lists into the parent's and credits the pare...

CVE-2026-93178 drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup

In the Linux kernel, the following vulnerability has been resolved: drm/amdgpu/pm/powerplay: bounds-check voltage index in SMU7 lookup vddInd and vddcInd fields from VBIOS-parsed tables are used to index into voltage lookup tables without a bounds check. Return -EINVAL when any index is out of...

CVE-2026-93173 bpf,lsm: Drop bpf_prog_free from sleepable_lsm_hooks

In the Linux kernel, the following vulnerability has been resolved: bpf,lsm: Drop bpfprogfree from sleepablelsmhooks bpfprogputrcu is the callrcu callback for non-sleepable programs. securitybpfprogfree called from there fires bpfprogfree in softirq; if a sleepable LSM prog is attached to that...