CVE-2026-84321 Nginx UI: Standalone short tokens survive administrative revocation in cache and authenticate again after account re-enable

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, GenerateShortToken creates standalone short-token records without a long Token value, but DeleteUserTokens invalidates cached entries only when the long Token field is nonempty. A revoked short token can therefore remain i...

CVE-2026-84314 Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user's password without passing RequireSecureSession, even though the self-service password-change path requires that step-up...

CVE-2026-84320 Nginx UI: Auto backup name allows path traversal outside validated storage path

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.3, Nginx UI validates an automatic backup's storagepath, but AutoBackup.GetName returns a user-controlled name without rejecting path separators or parent-directory components, and downstream filename formatting embeds that...

CVE-2026-84318 Nginx UI: MCP `nginx_config_add` Bypasses Directive Validation — Authenticated RCE

Nginx UI is a web user interface for the Nginx web server. From 2.0.0-rc.6 until 2.4.1, the MCP tool nginxconfigadd writes nginx configuration files to disk and triggers an nginx reload without calling config.ValidateConfigFile. The identical flow in the REST API POST /api/configs does call that...

CVE-2026-97691 Convex: Unauthorized data access

Convex is an open-source reactive database for application developers. Prior to the self-hosted image published on August 10, 2026 and local deployment binary precompiled-2026-08-10-c0cb7ae, a malicious user can, in rare cases, perform unauthorized reading of deployment information from a Convex...

CVE-2026-106495 Backstage: Improper access control in backend action invocation

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had excluded through action configuration...

CVE-2026-84315 Nginx UI OTP secure-session step-up is missing on sensitive mutation routes

Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen authenticated session...

CVE-2026-41508 OWASP Coraza WAF: Truncated multipart body bypasses MULTIPART_STRICT_ERROR (rule 200003) via silent io.ErrUnexpectedEOF handling

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.4.0 until 3.8.0, the multipart processor in internal/bodyprocessors/multipart.go treats io.ErrUnexpectedEOF as nonfatal without setting MULTIPARTSTRICTERROR. A remote attacker can submit a truncated...

CVE-2026-41504 OWASP Coraza WAF: Native audit-log format allows CRLF injection and log forgery via request body and header fields

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the Native audit-log formatter in internal/auditlog/formats.go writes attacker-influenced request and response fields without neutralizing carriage returns or line feeds. When...

CVE-2026-104774 OWASP Coraza WAF: jsDecode Off-by-One in Octal Escape Handling Enables WAF Bypass

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/jsdecode.go:64-70 includes the backslash in the octal buffer, causing ParseInt to fail and return a null byte. The flaw is...

CVE-2026-41510 OWASP Coraza WAF: Silent argument drop at ArgumentLimit allows bypass of ARGS-targeted rules via parameter flooding

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.1, Coraza silently drops arguments after SecArgumentsLimit in internal/corazawaf/transaction.go, while internal/bodyprocessors/urlencoded.go writes ARGSPOST without enforcing the cap. The fl...

CVE-2026-109425 Tink-go 2.8.0 Keyset Validation Bypass via NewHandleWithNoSecrets

Tink-go tink-crypto/tink-go through 2.8.0 contains an input-validation vulnerability where keyset.NewHandleWithNoSecrets and ReadWithNoSecrets skip the structural Validate step before constructing a keyset.Handle, allowing malformed public or no-secret keysets that violate Tink's keyset invariant...

CVE-2026-95838 containerd: Unpack DoS via repeated opaque whiteouts

containerd is an open-source container runtime. Prior to 1.7.35, 2.0.12, 2.2.8, and 2.3.5, containerd's layer unpack handler repeatedly traverses directories for certain opaque whiteout configurations. A malicious image layer can trigger repeated directory traversals while opaque whiteouts are...

CVE-2026-95837 containerd CRI plugin: Checkpoint restore bypasses destination security context

containerd is an open-source container runtime. From 2.1.0 until 2.2.7 and 2.3.4, containerd's CRI CreateContainer checkpoint restore is vulnerable because CRIU restores process security state from checkpoint data instead of enforcing the destination ContainerConfig. An attacker who can create a...

CVE-2026-109575

In HAProxy Data Plane API 2.2.0 through 3.4.3 and corresponding Enterprise Edition releases, Server.ConfigureAPI has process-global authentication logic that improperly drops security controls across multiple transport types. When a TLS Certificate Authority tlsca is configured and a numeric TLS...

CVE-2026-108924 getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization

A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/OptionsQuery.php of the component Dynamic Option Generation. The manipulation leads to authorization bypass. The attack is possible to be carried...

CVE-2026-108923 1024-lab smart-admin Support Config Query queryByKey access control

A vulnerability was determined in 1024-lab smart-admin up to 3.30.0. Affected by this vulnerability is an unknown functionality of the file /support/config/queryByKey of the component Support Config Query. Executing a manipulation of the argument configKey can lead to improper access controls. Th...

CVE-2026-108361 Privasys Intra-handshake attested TLS implementation is vulnerable to TOCTOU Attacks

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Before 0.9.1, an attacker with local access could modify workload code, data, and configuration at any time after successful connection establishment. Once Evidence was successfully...

CVE-2026-108362 Privasys attested TLS accepted evidence from any unrevoked TEE platform (diversion attack)

Privasys Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.11.0, TEE attestation evidence in Privasys attested TLS is accepted without requiring an explicitly authorized platform identity. When a network attacker can forge evidence...

CVE-2026-108922 KusalkaSilva Learning-Management-System upload_save.php getimagesize unrestricted upload

A flaw has been found in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. Affected is the function getimagesize of the file uploadsave.php. Executing a manipulation of the argument uploadedfile/image can lead to unrestricted upload. The attack may be launche...

CVE-2026-65954 PHPCSUtils: Remote code execution via eval() in AbstractArrayDeclarationSniff::getActualArrayKey()

PHPCSUtils is a suite of utility functions for use with PHPCodeSniffer. From 1.0.0-alpha1 until 1.2.3, PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey evaluates attacker-controlled array-key expressions with eval, allowing callback-form keys in untrusted PHP code scanne...

CVE-2026-102663 OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search

OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user's BasePath...

CVE-2026-108921 KusalkaSilva Learning-Management-System State-Changing Endpoints remove_announcements.php mysql_query missing authentication

A vulnerability was detected in KusalkaSilva Learning-Management-System up to ffeb873f8803f1e9664384ff75000c7da45466d2. This impacts the function mysqlquery of the file removeannouncements.php of the component State-Changing Endpoints. Performing a manipulation of the argument ID results in missi...

CVE-2026-89140 Temporal Server internal completion callbacks are not bound to their namespace, allowing cross-namespace changes to Scheduler V2 schedule state

Temporal Server does not bind internal completion callbacks to the namespace that attached them, which allows an authenticated caller with write permission in one namespace to alter Scheduler V2 schedule state in another namespace. The callback address temporal://internal is reserved for callback...

CVE-2026-104355 Temporal Server applies inbound namespace replication from a connected peer cluster to local namespaces

A connected peer cluster can modify a Temporal Server cluster's local namespaces, which are never replicated to that peer, because the receiving cluster applies inbound namespace replication updates to them. In a multi-cluster deployment, each cluster pulls replication tasks from the remote...

CVE-2026-59976 ConvertX: Path Traversal vulnerability leading to Arbitrary File Write

ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convertto parameter to construct an output path. If an authenticated user, or an unauthenticated user when ConvertX is configured to allow unauthenticated access, uploads an...

CVE-2026-59977 ConvertX: Cross-Site Request Forgery (CSRF) leading to Unauthorized Data Destruction

ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the /delete/id endpoint uses HTTP GET for permanent deletion without CSRF protection. If an authenticated user visits attacker-controlled content that requests /delete/id, the browser sends the user session cookie and the request...

CVE-2026-107226 AsyncHttpClient: Cookies received over plaintext HTTP can plant, overwrite or delete Secure cookies set over HTTPS

The AsyncHttpClient AHC library allows Java applications to easily execute HTTP requests and asynchronously process HTTP responses. From 2.1.0 until 3.0.14, the default ThreadSafeCookieStore does not retain whether a Set-Cookie response used a secure transport. It accepts Secure cookies received...

CVE-2026-104102 copyparty FTP: upload outside defined volumes (limited path traversal)

copyparty is a portable file server. Prior to 1.20.19, FTP upload path handling does not confine destinations to configured copyparty volumes. When FTP or FTPS is explicitly enabled, a low-privileged authenticated user can submit traversal paths during upload to create a new file outside configur...

CVE-2026-103061 Path traversal in Gleam via unvalidated package application names

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in gleam-lang gleam allows a malicious package publisher to delete a directory outside the project's build directory when a developer builds a project. A Hex package release's metadata carries an app field...

CVE-2026-77366 obsidian-tc tokens can access arbitrary configured vaults

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, the JSON Web Token JWT has no vault claim, and the folder access-control list is...

CVE-2026-77364 obsidian-tc fail-open default ACL exposes Obsidian control-directory secrets

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, undefined readPaths and writePaths settings allow all paths, strictReadDefault does not protect direct requests, and the .obsidian, .git, and .trash control directories are excluded only duri...

CVE-2026-77363 obsidian-tc Streamable HTTP transport permits cross-origin loopback vault access

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, the Streamable HTTP transport does not validate the Host or Origin header or enable DNS-rebinding protection. When the documented loopback configuration uses auth.mode set to none, a maliciou...

CVE-2026-109448 psqlODBC SQLBindParameter heap memory corruption when binding more than 32767 parameters

Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters the application binds on one statement, to corrupt heap memory. psqlODBC stores the binding count in a signed 16-bit field. Binding parameter number 32768 wraps that count to...

CVE-2026-105274 hex_core decompresses registry and Erlang term API responses without size limits

Improper Handling of Highly Compressed Data Data Amplification vulnerability in hexpm hexcore allows an untrusted repository mirror, or a server answering hexcore's API requests, to exhaust the memory of the Erlang VM running hexcore. The same code is vendored in Hex mixhexrepo, mixhexapi and...

CVE-2026-109374 ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation

ZITADEL 3.0.0 before 4.19.2 contains a privilege escalation vulnerability in OIDC token exchange that allows end-user impersonators to impersonate administrators including IAMOWNER by bypassing the admin.impersonation check. Attackers holding IAMENDUSERIMPERSONATOR or ORGENDUSERIMPERSONATOR roles...

CVE-2026-109373 ZITADEL 3.0.0 before 4.19.2 Account Takeover via Unsigned Login V2 Session Cookie

ZITADEL 3.0.0 before 4.19.2 contains an authentication bypass vulnerability in the Login V2 UI that allows unauthenticated attackers to obtain other users' session tokens by forging unsigned session cookies. Attackers can guess time-ordered session IDs around a victim's sign-in and supply them wi...

CVE-2026-109372 ZITADEL 3.0.0 before 4.19.2 Account Takeover via SAML Identity-Provider Confusion

ZITADEL 4.x before 4.19.2 and 3.x through 3.4.15 contains an authentication bypass in the SAML identity-provider intent callback, which verifies the assertion signature using the provider named in the request URL but resolves the user from the login intent without checking they match. Attackers...

CVE-2026-109371 ZITADEL 3.0.0 before 4.18.0 Unauthenticated Username Change via Login V1

ZITADEL 3.0.0 before 4.18.0 contains a missing authentication vulnerability in the hosted Login V1 UI, where the change-username handler acts on the account bound to a login flow before any factor is verified. Unauthenticated attackers can submit a victim's login name and then post a new username...

CVE-2026-109366 Zebra before 6.4.0 Gossiped Block Drop via Forged Coinbase scriptSig Height

Zebra before 6.4.0 contains an improper integrity validation vulnerability in the inbound gossip download path that allows unauthenticated peers to force dropping of new blocks without penalty. Attackers can serve a real block with a coinbase scriptSig rewritten to height 1, which keeps the ZIP-2...

CVE-2026-109364 Zebra 2.3.0 before 6.4.0 Peer Ban Bypass via Exact-IP Keying

Zebra 2.3.0 before 6.4.0 contains a protection mechanism failure that allows unauthenticated peers to evade bans because bans and misbehavior scores are keyed on exact IP addresses. Attackers can reconnect from fresh IPv6 addresses in their /64 allocation or flush the 20,000-entry FIFO ban list t...

CVE-2026-109365 Zebra before 6.4.0 Denial of Service via Same-Hash Forged Block Bodies

Zebra before 6.4.0 contains an uncontrolled resource consumption vulnerability that allows unauthenticated peers to force full proof verification by serving forged block bodies with valid header hashes. Attackers can flip authorizing-only bytes such as a coinbase scriptSig, wasting Sapling,...

CVE-2026-109363 Zebra 6.4.0 before 6.4.2 Denial of Service via Malformed v6 Transaction

ZcashFoundation Zebra 6.4.0 before 6.4.2 parses version 6 transactions carrying a pre-NU6.3 consensus branch ID, but the size computation during UnminedTx construction treats re-serialization of the Orchard bundle as infallible, so the resulting error trips an expect that aborts zebrad...

CVE-2026-109362 Heym v0.0.5 before v0.0.113 Broken Access Control via Workflow Execution Tokens

Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing scoped workflow:execute tokens after share removal. Attackers can mint a token with a TTL up to 10 years, which the owner cannot list or...

CVE-2026-109361 MONAI 1.2.0 before 1.6.1 Insecure Deserialization RCE via nnUNetV2Runner postprocessing_file Path

MONAI 1.2.0 before 1.6.1 contains an insecure deserialization vulnerability in nnUNetV2Runner that unpickles the postprocessingfile path read from inferenceinformation.json without confining it to the results directory. Attackers who can modify inferenceinformation.json can point it at a maliciou...

CVE-2026-109360 MONAI 0.4.0 before 1.6.1 RCE via SENet Pretrained Weights Over Plaintext HTTP

MONAI 0.4.0 before 1.6.1 contains a remote code execution vulnerability that allows on-path attackers to execute code by tampering with SENet pretrained weights fetched over plaintext HTTP. Attackers can substitute a crafted .pth file that loadstatedictfromurl unpickles without weightsonly=True,...

CVE-2026-109359 Contrast 1.8.0 before 1.24.1 Mesh CA Key Cross-Manifest Exposure via Peer Recovery

Contrast 1.8.0 before 1.24.1 contains an improper verification vulnerability in Coordinator peer recovery that fails to confirm the serving peer uses the same manifest generation. Attackers with write access to manifest history can replay a superseded history head so withdrawn workloads obtain...

CVE-2026-109358 Edgeless Systems Contrast 1.8.0 before 1.24.1 World-Writable Containerd Config Privilege Escalation

Edgeless Systems Contrast 1.8.0 before 1.24.1 contains an incorrect permissions vulnerability where the node installer writes the containerd config world-writable 0666. Local unprivileged users on the node can modify the containerd config, for example overwriting the runc location, to escalate...

CVE-2026-109356 LibreNMS before 26.9.0 Missing Authorization in Port Purge via PortsController

LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges. Attackers with read-only accounts can send DELETE requests to /ports/purge, using purge=all to irreversibly erase eve...

CVE-2026-109357 LibreNMS before 26.9.0 LDAP Filter Injection Authentication Bypass via Authorization Header

LibreNMS before 26.9.0 contains an LDAP filter injection in ldap-authorization and ad-authorization modes because usernames are inserted unescaped into LDAP search filters and authentication only checks user existence. When REMOTEUSER is not forwarded, unauthenticated attackers can send a wildcar...