CVE-2026-107212 Excelize: Unbounded row number in Rows.Columns makes GetRows and the Rows iterator loop for days

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.1.0 to 2.11.0, Rows.Columns accepts a look-ahead row number above TotalRows without applying the limit enforced by Rows.Next. File.GetRows relies on Rows.Next and Rows.Columns, but Rows.Columns consumes...

CVE-2026-107211 Excelize: Unchecked pivot-cache field index in extractPivotTableFields causes unrecoverable panic

Excelize is a Go language library for reading and writing Microsoft Excel spreadsheets. From 2.8.1 to 2.11.0, separately parsed pivot-table field indices are used to index the pivot-cache field-name slice without bounds checks. extractPivotTableFields uses getPivotCacheFieldsName output while...

CVE-2026-92543 Docker Engine insecure-registry fallback via malicious DNS responses

Docker Engine classifies a registry hostname as insecure using an any-match DNS check. loadInsecureRegistries injects 127.0.0.0/8 and ::1/128 as insecure CIDRs by default. isCIDRMatch resolves all of the hostname's addresses and returns true if a single address is in the insecure CIDR list. Becau...

CVE-2026-92542 Blind VXLAN injection into encrypted overlay networks from cluster peer

The firewall rules which mark VXLAN datagrams for encryption indiscriminately match both authentic VXLAN datagrams sent from the kernel and forged datagrams sent by user processes. Any packet sent from the host network namespace of a Linux Swarm node is encrypted with the overlay-network IPsec...

CVE-2026-106557 Backstage: Improper input validation in TechDocs Markdown extension configuration

Backstage is an open framework for building developer portals. Prior to 1.14.6 and 1.15.4, the @backstage/plugin-techdocs-node package did not sufficiently validate TechDocs Markdown extension configuration. An authenticated user who can register or modify documentation sources may cause a TechDo...

CVE-2026-62252 Homer: Hardcoded Default Admin Password 'sipcapture' With No Forced Change on First Login

Homer is open source telecom observability software. Prior to version 11.0.283, on every fresh Homer deployment using internal authentication, the bootstrap process automatically creates an admin account with the password sipcapture stored as a legacy SHA-256 hex hash. There is no first-login...

CVE-2026-62253 Homer: Complete Authentication Bypass When coordinator.jwt.secret Is Empty (Default)

Homer is open source telecom observability software. Prior to version 11.0.283, both JWT middleware functions JWTMiddleware and JWTMiddlewareV4 immediately return nextc when jwtSecret == "". The JWT secret defaults to an empty string. On a default installation, all protected API endpoints under...

CVE-2026-62251 Homer: Authenticated SQL Injection via Unvalidated rawquery Field in /api/v4/statistics/query

Homer is open source telecom observability software. Prior to version 11.0.283, the V4StatisticsQuery handler passes the user-supplied rawquery field directly to DuckDB without calling the sqlvalidator.ValidateRawSQL function used throughout the rest of the codebase. Any authenticated user can...

CVE-2026-62176 PraisonAI: Code Injection via f-string Interpolation in Deploy API Server Generation

PraisonAI is a multi-agent teams system. Prior to version 4.6.78, the deploy/api.py module generates Python server code by directly interpolating the agentsfile parameter into an f-string that is then written to a file and executed via subprocess.Popen. An attacker who controls the agentsfile val...

CVE-2026-107166 Open5GS GTP-U Receive Path gtp-path.c ogs_pfcp_xact_local_create allocation of resources

A weakness has been identified in Open5GS up to 2.7.7. This vulnerability affects the function ogspfcpxactlocalcreate of the file src/upf/gtp-path.c of the component GTP-U Receive Path. This manipulation causes allocation of resources. The attack is possible to be carried out remotely. The exploi...

CVE-2026-107210 ImageMagick: Policy Bypass in MAT decoder when reading highly compressed data

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted highly compressed MAT image can make the MAT decoder create temporary files larger than the configured security-policy limit, bypassing resource restrictions a...

CVE-2026-107209 ImageMagick: Use-After-Free in RSVG decoder that is build without cairo support

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, when ImageMagick is built without Cairo support, a crafted RSVG image that reaches a resource limit can cause the RSVG decoder to free image state twice and then use fre...

CVE-2026-107208 ImageMagick: Denial of service with crafted XMP profile

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a crafted XMP profile can reach a recursion limit that is handled as a fatal condition instead of an ordinary exception, terminating the image-processing process. This...

CVE-2026-106580 ImageMagick: Policy Bypass in CUT encoder

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing security-policy check in the CUT encoder allows a crafted local encoding operation to read data that policy should deny and can also cause a crash. This issue ...

CVE-2026-92415 Apache Jackrabbit: DavEx client runs Class.forName + (String)-constructor on server-controlled error bodies

— Use of Externally-Controlled Input to Select Classes or Code vulnerability in Apache Jackrabbit's WebDAV/Davex client. A malicious WebDAV/DavEx server, or an attacker able to intercept the connection, can cause the client to instantiate arbitrary classes from its classpath, which can lead to...

CVE-2026-92414 Apache Jackrabbit: Pre-auth hijack of cached sessions via derivable WebDAV lock tokens

: Session Fixation / Session Reuse across Users vulnerability in Apache Jackrabbit. Jackrabbit WebDAV server attaches a cached authenticated session on any Lock-Token/TransactionId/SubscriptionId/If-header field token match with no credential check. This issue affects Apache Jackrabbit: from 2.23...

CVE-2026-106579 ImageMagick: Policy Bypass when using coder as the domain.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an ImageMagick security policy that uses coder as its domain, potentially allowing data prohibited by the policy to be read. This issue is fix...

CVE-2026-107273 Gophish 0.11.0 through 0.12.1 SSRF via POST /api/import/site

Gophish 0.11.0 through 0.12.1 contains a server-side request forgery vulnerability that allows authenticated low-privileged users to reach loopback and private hosts via POST /api/import/site. Attackers can submit internal URLs, which the default dialer deny list does not block, to read service...

CVE-2026-107272 Gophish through 0.12.1 XSS via Unescaped SMTP Server Error Messages

Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error messages. Attackers controlling or intercepting a sending profile's SMTP server can execute script when administrators view...

CVE-2026-107271 Gophish through 0.12.1 Login Rate Limit Bypass via X-Forwarded-For Spoofing

Gophish through 0.12.1 contains a rate limit bypass vulnerability that allows unauthenticated attackers to evade /login throttling by spoofing X-Forwarded-For or X-Real-IP headers. Attackers can send a different forwarded address per request so the limiter keyed on rewritten RemoteAddr never...

CVE-2026-107270 Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints

Gophish through 0.12.1 contains an insecure direct object reference vulnerability that allows authenticated users to take over other users' groups, templates, landing pages and sending profiles. Attackers can supply another user's sequential id in POST requests to /api/groups/, /api/templates/,...

CVE-2026-107278 MISP Object Sync Drops Objects and Attributes When Description Is Empty

MISP contains a validation flaw in its object synchronization logic. When a MISP Object is created without a description, it is stored correctly on the originating instance. However, when that object is replicated to another MISP instance via the sync mechanism, the receiving instance's validatio...

CVE-2026-106578 ImageMagick: Invalid Memory Free in MVG decoder

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can cause an invalid memory free in the MVG decoder and crash the process. This issue is fixed in versions 7.1.2-31 and 6.9.13-56...

CVE-2026-107269 Gophish through 0.12.1 Username Enumeration via POST /login Timing Discrepancy

Gophish through 0.12.1 contains a timing discrepancy vulnerability in AdminServer.Login that allows unauthenticated attackers to enumerate valid usernames by measuring login response times. Attackers can submit candidate usernames to POST /login and detect bcrypt comparison delays for existing...

CVE-2026-106577 ImageMagick: Code Injection in the postscript coders

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, unescaped or untrimmed values can inject code into output generated by PostScript coders. This issue is fixed in versions 7.1.2-31 and 6.9.13-56...

CVE-2026-106576 ImageMagick: Denial of service possible when parsing an XMP profile.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted XMP profile can trigger excessive work while the parser determines a rational value's numerator and denominator, causing denial of service. This issue is fixed in version...

CVE-2026-107276 MISP Email OTP Race Condition Allows One-Time Password to Be Consumed by Multiple Concurrent Requests

MISP contains a race condition in the email-based one-time password OTP login flow. When two HTTP requests carrying the same valid OTP are submitted concurrently, both can successfully authenticate and establish a session. The root cause is that the OTP value is read from the shared store,...

CVE-2026-106575 ImageMagick: Unclosed file pointer in magick script

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a crafted Magick script can cause an opened file pointer to remain unclosed, allowing repeated processing to exhaust available file descriptors. This issue is fixed in version 7.1.2-3...

CVE-2026-106574 ImageMagick: Heap Buffer Over-Write in distributed pixel cache server will result in a crash

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31, a client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap buffer overwrite, crashing the server...

CVE-2026-106573 ImageMagick: Denial of service in MVG decoder

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing limit check in the MVG decoder allows a crafted MVG image to trigger an excessively long-running operation. This issue is fixed in versions 7.1.2-31 and...

CVE-2026-106572 ImageMagick: Stack Overflown CALS decoder due to missing depth check.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-30 and 6.9.13-55, a missing recursion-depth check in the CALS decoder allows a crafted CALS image to exhaust the call stack and terminate the process. This issue is fixed in versions...

CVE-2026-106571 ImageMagick: Heap Buffer Over-Write in GetVirtualPixels api will result in a crash

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 6.9.13-56 and 7.1.2-31, a crafted local call to the GetVirtualPixels API can trigger an integer calculation error and write beyond a heap buffer, crashing the server process. This issue is fixe...

CVE-2026-106570 ImageMagick: Denial of service in distributed pixel cache server

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, an unauthenticated adjacent-network client can repeatedly connect to the distributed pixel cache server and exhaust its available connections, causing denial of service. This issue is...

CVE-2026-106569 ImageMagick: Denial of service in ASE decoder because of missing security checks

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, missing validation and resource checks in the ASE decoder allow a crafted ASE image to cause a crash or a long-running operation. This issue is fixed in version 7.1.2-32...

CVE-2026-106568 ImageMagick: Infinite Loop when reading a crafted XMP profile

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted XMP profile embedded in an image can cause the profile parser to enter an infinite loop, preventing image processing from completing. This issue is fixed in...

CVE-2026-107207 LMCache through 0.5.5 Missing Authentication in Frontend Node Catalog Allows SSRF Allowlist Bypass

LMCache through 0.5.5 contains a server-side request forgery vulnerability in its frontend monitoring service that allows unauthenticated attackers to bypass the proxy allowlist by registering arbitrary hosts. Attackers can add entries via POST /api/proxies and then use /proxy or /proxy2 to reach...

CVE-2026-107206 LMCache through 0.5.5 Missing Authentication in MP HTTP Server Management API

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration...

CVE-2026-107205 LMCache through 0.5.5 Missing Authentication in MP Coordinator Fleet Control API

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess coordinator that allows remote unauthenticated attackers to access its HTTP fleet control API listening on all interfaces by default. Attackers can register or deregister instances via /instances, overwrite...

CVE-2026-107204 LMCache through 0.5.5 Unauthenticated RCE via /run_script Endpoint

LMCache through 0.5.5 contains an unauthenticated remote code execution vulnerability that allows remote attackers to execute Python code by posting scripts to the /runscript endpoint. Attackers can recover real builtins through the injected FastAPI app object, bypassing the guarded import, to...

CVE-2026-106567 ImageMagick: Infinite Loop in PSD decoder on 32-bit builds

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a crafted PSD file can trigger an integer-conversion error in the PSD decoder on 32-bit builds, causing an infinite loop and denial of service. This issue is fixed in...

CVE-2026-106566 ImageMagick: Policy Bypass in delegate symlink cleanup due to missing check

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, delegate symlink cleanup does not check the MAGICKSHREDPASSES environment variable, allowing a local privileged workflow to overwrite a file with random data. This issue is fixed in...

CVE-2026-106565 ImageMagick: Infinite Loop in bzip2 compressed images.

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32 and 6.9.13-57, a missing end-of-file check while reading bzip2-compressed image data can cause an infinite loop and exhaust processing resources. This issue is fixed in versions 7.1.2-...

CVE-2026-106564 ImageMagick: Heap Buffer Over-Write in EXR decoder

ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, a crafted EXR image can cause the EXR decoder to write beyond a heap buffer, causing the process to crash. This issue is fixed in version 7.1.2-32...

CVE-2026-106563 Backstage: Improper entity validation in deprecated Kubernetes services endpoint

Backstage is an open framework for building developer portals. Prior to 0.21.8, the @backstage/plugin-kubernetes-backend package is affected by improper entity validation in deprecated kubernetes services endpoint. An authenticated user with Kubernetes read permissions could access Kubernetes...

CVE-2026-106562 Backstage: Incorrect authorization in search engine permission filtering

Backstage is an open framework for building developer portals. Prior to 2.1.6 in @backstage/plugin-search-backend and 1.8.7 in @backstage/plugin-search-backend-module-elasticsearch, search engine permission filtering could return documents denied by policy. An authenticated Backstage user subject...

CVE-2026-106561 Backstage: Sensitive information disclosure in Kubernetes resource queries

Backstage is an open framework for building developer portals. Prior to 0.21.9, the @backstage/plugin-kubernetes-backend package is affected by sensitive information disclosure in kubernetes resource queries. An authenticated user holding the standard Kubernetes resource read permission could...

CVE-2026-106560 Backstage: Improper repository path validation in a Scaffolder backend module

Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper repository path validation in a scaffolder backend module. An authenticated user who can execute an affected...

CVE-2026-106559 Backstage: Improper input validation in Confluence to Markdown scaffolder module

Backstage is an open framework for building developer portals. Prior to 0.3.25, the @backstage/plugin-scaffolder-backend-module-confluence-to-markdown package is affected by improper input validation in confluence to markdown scaffolder module. Insufficient input validation in the Confluence to...

CVE-2026-106558 Backstage: Improper validation of TechDocs MkDocs configuration

Backstage is an open framework for building developer portals. Prior to 1.14.8, 1.15.6, and 2.0.1, the @backstage/plugin-techdocs-node package improperly validated mapping-style markdownextensions configuration. An authenticated attacker who can register or influence an SCM-backed documentation...

CVE-2026-106556 Backstage: Configuration bypass in TechDocs mkdocs.yml sanitization

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an...