CVE-2026-108982: Incomplete Cleanup

VeraCrypt 1.26.29 FUSE-T build on macOS sometimes allows unintended access to decrypted data. It does not terminate the FUSE-T auxiliary service go-nfsv4 and its associated VeraCrypt core-service helper processes when a volume is dismounted. After VeraCrypt reports the volume as dismounted, the...

CVE-2026-109290: Improper Neutralization of Input During Web Page Generation

Open WebUI from 0.11.1 before 0.11.4 contains a stored cross-site scripting vulnerability in DocxPreview.svelte that allows authenticated users to execute script by uploading crafted DOCX attachments. Attackers can embed an OOXML altChunk HTML part or script-scheme hyperlink to steal a previewing...

CVE-2026-109295: Inefficient Regular Expression Complexity

Open WebUI from 0.11.0 before 0.11.4 contains a regular expression denial of service vulnerability that allows authenticated users to stall server workers via file search patterns. Attackers can instruct the model to call grepknowledgefiles or grepchatfiles with a catastrophically backtracking...

CVE-2026-103529: Unrestricted Upload of File with Dangerous Type

Thelia v2.6.0 permits authenticated administrators to upload and install modules via the ZIP upload function without validating or sandboxing embedded PHP code. An attacker can include malicious PHP code in a module's install method which will then be executed upon installation, enabling remote...

CVE-2026-107248: Improper Control of Generation of Code

Thelia 3.0.0's back-office Email/Messages feature contains a server‑side template injection SSTI flaw that allows any authenticated user with the “Messages” permission to supply unsandboxed Twig templates, which are then compiled and executed as raw code. By modifying Message content, an attacker...

CVE-2026-102663: Exposure of Sensitive Information to an Unauthorized Actor

OpenList is a file list program that supports multiple storage backends. Prior to 4.2.4, the OpenList search API uses a non-separator-aware strings.HasPrefix comparison as a path containment authorization check when authorizing globally indexed Bleve results against a restricted user's BasePath...

CVE-2026-103526: Observable Response Discrepancy

In Thelia v2.6.0, both the administrative login and forgotten password endpoints return different responses for invalid usernames and incorrect passwords, allowing unauthenticated attackers to enumerate valid administrator accounts. Because the endpoint also lacks rate limiting or other protectio...

CVE-2026-103521: Unrestricted Upload of File with Dangerous Type

In Thelia v2.6.0, the document upload endpoint properly blocks the upload of executable file types, but the document update endpoint does not perform the same validation. An attacker with administrative Thelia permissions can exploit this vulnerability to upload arbitrary executable files, such a...

CVE-2026-104774: Encoding Error

OWASP Coraza WAF is a golang modsecurity compatible web application firewall library. From 3.0.0 until 3.8.0, the t:jsDecode transformation in internal/transformations/jsdecode.go:64-70 includes the backslash in the octal buffer, causing ParseInt to fail and return a null byte. The flaw is...

CVE-2026-105283: Generation of Error Message Containing Sensitive Information

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to read internal Elixir terms from an RPC error response by provoking an error the error builder has no dedicated clause for...

CVE-2026-103080: External Control of Assumed-Immutable Web Parameter

External Control of Assumed-Immutable Web Parameter vulnerability in VillaTheme Salevo woo-boost-sales allows Input Data Manipulation.This issue affects Salevo: from n/a through 1.3.0...

CVE-2026-103061: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in gleam-lang gleam allows a malicious package publisher to delete a directory outside the project's build directory when a developer builds a project. A Hex package release's metadata carries an app field...

CVE-2026-103060: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package release's...

CVE-2026-103060: Improper Limitation of a Pathname to a Restricted Directory

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in erlang rebar3 allows a malicious package publisher to delete a directory outside the project's build directory and extract package files into it when a developer fetches dependencies. A package release's...

CVE-2026-105465: Improper Privilege Management

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to privilege escalation when db2locssh is enabled with the db2 instance...

CVE-2026-105466: Allocation of Resources Without Limits or Throttling

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 is vulnerable to a denial of service when inserting into a table with XML columns under specific conditions...

CVE-2026-106495: Improper Access Control

Backstage is an open framework for building developer portals. Prior to 0.17.8, the @backstage/backend-defaults package is affected by improper access control in backend action invocation. An authenticated user could invoke actions that an operator had excluded through action configuration...

CVE-2026-19622: Authentication Bypass Using an Alternate Path or Channel

IBM Planning Analytics 2.0, and 2.1 could allow a remote attacker to bypass authentication and escalate privileges due to improper validation of sub-requests...

CVE-2026-103524: Improper Neutralization of Input During Web Page Generation

Thelia v2.6.0 is vulnerable to multiple stored XSS vulnerabilities within the administrative interface. User-supplied input is stored without sufficient output encoding or sanitization and is later rendered in the administrator interface and/or the web store's product pages, allowing arbitrary...

CVE-2026-103523: URL Redirection to Untrusted Site

Thelia v2.6.0 contains an open redirect vulnerability in its address creation workflow. After a user accesses a crafted URL and successfully submits the “Add New Address” form, the application redirects them to the URL specified in the next parameter. Because the application does not validate...

CVE-2026-103527: Improper Neutralization of Input During Web Page Generation

Thelia v2.6.0's Smarty templates address.html and address-update.html fail to properly escape double quotes in the “next” parameter, enabling reflected Cross‑Site Scripting XSS when an authenticated user visits the malicious link containing attacker‑controlled JavaScript...

CVE-2026-102539: Cleartext Storage of Sensitive Information

Super Productivity is an advanced todo list app with integrated timeboxing and time tracking capabilities. From 17.3.0 until 18.13.1, the SuperSync end-to-end encryption setup calls synctrue before a user sets an encryption password, causing the operation-upload path to transmit and store all use...

CVE-2026-102596: Missing Authorization

Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled through a plan with hasrbac=true, two private flow-read routes, GET /api/v1/integrations/:providerConfigKey/flows and GET /api/v1/flow/:flowName, apply webAuth b...

CVE-2026-104140: Improper Neutralization of Input During Web Page Generation

QGIS is a free, open source, cross-platform geographic information system. Prior to 3.44.12 and 4.0.0 through 4.2.3, QGIS Server renders feature data in WFS3 OGC API Features HTML responses without HTML escaping. Attacker-controlled feature.properties values from a published writable vector layer...

CVE-2026-103503: Improper Certificate Validation

Improper Certificate Validation vulnerability in hexpm hex allows an attacker who can intercept HTTPS connections, and holds a certificate for a Hex host issued by a CA in Hex's bundled CA store, to impersonate that host to users who set cacertspath to a CA store that leaves that CA out...

CVE-2026-105052: Improper Limitation of a Pathname to a Restricted Directory

IBM Maximo Application Suite 8.10, 8.11, 9.0, 9.1, and 9.2 could allow a remote attacker to traverse directories on the system. An attacker could send a specially crafted URL request containing "dot dot" sequences /../ to view arbitrary files on the system...

CVE-2026-103502: Improper Certificate Validation

Improper Certificate Validation vulnerability in hexpm hexcore allows an attacker who can intercept HTTPS connections to impersonate hex.pm, repo.hex.pm or any other repository or API server to programs that use hexcore's default HTTP adapter on Erlang/OTP 24, or on OTP 25 when the operating...

CVE-2026-103522: Unrestricted Upload of File with Dangerous Type

In Thelia v2.6.0, the store banner upload feature performs insufficient filetype validation that relies exclusively on client‑supplied MIME types. An attacker with administrative access can upload a PHP file disguised as an image to bypass validation and achieve remote code execution on the...

CVE-2026-105668: Protection Mechanism Failure

Protection Mechanism Failure vulnerability in hexpm hex allows the owner of a package, or an attacker who has taken over the owner's account, to get a newly published release past the release-age cooldown. The cooldown cooldown config, HEXCOOLDOWN withholds versions younger than the configured ag...

CVE-2026-103528: Improper Neutralization of Special Elements Used in a Template Engine

Thelia 2.6.0 uses Smarty for email templates without properly restricting access to dangerous PHP functions. An authenticated administrator can inject malicious Smarty expressions into email templates via the messages configuration interface, and when the template is previewed or rendered,...

CVE-2026-21116: Out-of-bounds Write

Out-of-bounds write in libsmkvextractor.so prior to SMR Oct-2026 Release 1 allows local attackers to write out-of-bounds memory...

CVE-2026-21117: Improper Access Control

Improper access control in CocktailBarService prior to SMR Oct-2026 Release 1 allows local attackers to access sensitive information...

CVE-2026-21118: Improper Access Control

Improper access control in DownloadProvider prior to SMR Oct-2026 Release 1 allows local attackers to access files in scoped storage...

CVE-2026-21122: Out-of-bounds Write

Out-of-bounds write in libsamsungtts.so prior to SMR Oct-2026 Release 1 allows local attackers to execute arbitrary code...

CVE-2026-21121: Improper Handling of Insufficient Permissions or Privileges

Improper handling of insufficient permission in CmcCore prior to SMR Oct-2026 Release 1 allows local attackers to use the privileged APIs...

CVE-2026-21120: Use After Free

Use after free in WSM service prior to SMR Oct-2026 Release 1 allows local attackers to potentially execute arbitrary code with system privilege...

CVE-2026-21119: Undefined Security Weakness

Out-of-bounds read and write in libsagaisoundsepv2.00.so prior to SMR Oct-2026 Release 1 allows local attackers to read and write out-of-bounds memory...

CVE-2026-109252: NULL Pointer Dereference

FreeRDP from 3.9.0 before 3.32.0 contains a NULL pointer dereference vulnerability in the RDPEAR NDR reader that allows malicious servers to crash clients via truncated KERBRPCINTERNALNAME data. Attackers can send a CreateApReqAuthenticatorReq with NameCount of two or more ending before the Names...

CVE-2026-109327: Improper Neutralization of Input During Web Page Generation

Admidio 4.0.12 through 4.3.17 and 5.0.0 before 5.0.15 contains a reflected cross-site scripting vulnerability in system/redirect.php that allows unauthenticated attackers to inject JavaScript via the url GET parameter, due to an incomplete fix for CVE-2021-43810. Attackers can craft a javascript:...

CVE-2026-109560: Incorrect Authorization

Continue CLI @continuedev/cli through 1.5.47 contains a permission bypass vulnerability that allows attackers to run unapproved commands by chaining them after allowed Bash prefix rules. Attackers can inject instructions into repository files or fetched pages so the agent appends commands after ;...

CVE-2026-109251: Improper Validation of Array Index

FreeRDP before 3.32.0 stores the server-supplied signed MS-RDPEGT geometry origin unchecked in an unsigned video surface coordinate, so the blit clamp in gdiVideoShowSurface wraps in 32-bit arithmetic and is skipped. A malicious RDP server can send a negative topLevelLeft to clients connecting wi...

CVE-2026-109330: Missing Origin Validation in WebSockets

Network-AI 5.0.0 before 5.15.2 contains a cross-site WebSocket hijacking vulnerability in DashboardServer that allows remote attackers to read live agent topology because handleUpgrade performs no Origin or token validation. Attackers can lure a victim running the dashboard to a malicious page th...

CVE-2026-109248: Out-of-bounds Read

FreeRDP 3.0.0 before 3.32.0 contains a heap out-of-bounds read in the WinPR clipboard function convertfiledescriptorstofilelist, which scans a server-controlled FILEDESCRIPTORW cFileName with unbounded wcschr and countspecialchars calls without a NUL-termination guarantee. A malicious RDP server...

CVE-2026-109573: Improper Neutralization of Special Elements used in an SQL Command

phpMyFAQ before 4.1.9 contains an SQL injection vulnerability in PdoMysql::escape, which escapes single quotes with backslashes that are treated literally when MySQL or MariaDB runs in NOBACKSLASHESCAPES mode. Unauthenticated attackers can send a Unicode right single quotation mark in the search...

CVE-2026-109362: Insufficient Session Expiration

Heym v0.0.5 before v0.0.113 contains a broken access control vulnerability that allows former collaborators to keep executing JWT-auth workflows by reusing scoped workflow:execute tokens after share removal. Attackers can mint a token with a TTL up to 10 years, which the owner cannot list or...

CVE-2026-109293: Exposure of Sensitive Information to an Unauthorized Actor

Open WebUI from 0.11.0 before 0.11.4 contains an information disclosure vulnerability that allows authenticated non-admin users with tool export permission to obtain tool source code shared with them read-only. Attackers can request GET /api/v1/tools/export to retrieve the full Python source of...

CVE-2026-109352: Improper Neutralization of Input During Web Page Generation

LibreNMS before 26.9.0 contains a stored cross-site scripting vulnerability in includes/html/pages/device/wireless.inc.php, which echoes wireless sensor sensordescr values, populated from SNMP DisplayString fields during discovery, into HTML without escaping. Attackers controlling a monitored...

CVE-2026-109296: Authorization Bypass Through User-Controlled Key

Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an explicit backend index. Attackers can pass the index as a path segment or query parameter on Ollama and OpenAI-compatible listing route...

CVE-2026-109288: Improper Neutralization of Input During Web Page Generation

Open WebUI before 0.11.4 contains a stored cross-site scripting vulnerability in MarkdownInlineTokens.svelte, which renders markdown link URLs into anchor hrefs without validating their scheme. Authenticated users can embed javascript: links in shared chats that, when clicked by a victim, steal t...

CVE-2026-109353: Improper Neutralization of Special Elements used in an SQL Command

LibreNMS before 26.9.0 contains an SQL injection vulnerability that allows unprivileged users to inject SQL by supplying an array-valued notificationid parameter to notifications.inc.php. Attackers can perform cross-table reads of users.password hashes, with results persisted in...