CVE-2026-108709: Undefined Security Weakness

Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.4 through 5.0.4. Users are recommended t...

CVE-2026-111678: Out-of-bounds Read

Antiword through 0.37 contains a stack out-of-bounds read vulnerability in vGet8PapInfo and vGet8ChrInfo in prop8.c because FKP run counts and grpprl offsets are not bounded. Attackers can supply a crafted .doc file with malicious FKP pages to read past the 512-byte stack buffer, crashing antiwor...

CVE-2026-111677: Out-of-bounds Read

Antiword through 0.37 contains a heap out-of-bounds read vulnerability in vGet8LstInfo in prop8.c caused by an inverted bounds check on the PlcfLst record count. Attackers can supply a crafted Word 8 .doc file claiming up to 0xffff LSTF records in a tiny buffer, causing reads past the heap...

CVE-2026-95183: Undefined Security Weakness

An issue in the context-compaction feature of DeepSeek Harness dsh commit c291e796 allows attackers to execute a prompt injection attack via crafted external content...

CVE-2026-77630: Uncontrolled Resource Consumption

pupnp is an SDK for development of UPnP device and control point applications. Prior to 22.0.4, parsehostport in upnp/src/genlib/net/uri/uri.c synchronously calls getaddrinfo while parseuri is processing attacker-supplied hostnames from inbound HTTP request targets in...

CVE-2026-69076: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are...

CVE-2026-68573: Improper Authentication

Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin...

CVE-2026-68572: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue...

CVE-2026-69080: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue...

CVE-2026-69077: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Use...

Red Hat: CVE-2026-110756: perl-text-csv_xs: Text::CSV_XS: Data corruption via invalid UTF-8 byte sequences

Text::CSVXS versions before 1.65 for Perl drop the end of a record and its line ending when a UTF-8 flagged field precedes invalid UTF-8 bytes in print. When a record contains a UTF-8 flagged field, print holds back trailing bytes that are not valid UTF-8 at each buffer flush, so that a character...

CVE-2026-110755: Inefficient Algorithmic Complexity

Text::CSVXS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the...

Red Hat: CVE-2026-110755: perl-text-csv_xs: Text::CSV_XS: Denial of Service via crafted carriage return line endings

Text::CSVXS versions before 1.65 for Perl allow quadratic CPU use by copying the unparsed remainder per record of CR-only input in getline. With eol unset, the default, getline reads with Perl's default line separator, so input with CR-only line endings arrives as one chunk. After each record the...

CVE-2026-110754: Missing Release of Memory after Effective Lifetime

Text::CSVXS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never fre...

Red Hat: CVE-2026-110754: perl-Text-CSV_XS: perl-Text-CSV_XS: Denial of Service via memory leak during malformed CSV parsing

Text::CSVXS versions before 1.65 for Perl leak the parsed fields of a record that fails to parse in getline. getline collects the fields of a record into a new array and returns a reference to it only when the parse succeeds. When the record has a syntax error, getline returns undef and never fre...

CVE-2026-110753: Use After Free

Text::CSVXS versions from 1.46 before 1.65 for Perl have a use-after-free of bindcolumns variables when skipemptyrows skips an empty line in getline. With bindcolumns, the parser writes each field into the caller's own scalar without taking a reference to it. When skipemptyrows skips an empty las...

CVE-2026-89096: Missing Release of Resource after Effective Lifetime

A flaw was found in nfs-utils. An unauthenticated remote attacker can trigger a Denial of Service DoS by sending repeated state notification requests to an exposed rpc.statd service. The service fails to properly release memory allocated during callback processing, leading to continuous memory...

CVE-2026-89088: Out-of-bounds Write

A flaw was found in parted. A heap-based buffer overflow exists in libparted's file system resizing logic when handling FAT16 volumes. By convincing a user or administrator to resize a specially crafted FAT16 file system image with malformed directory metadata, an attacker can trigger an oversize...

CVE-2026-89085: Out-of-bounds Write

A flaw was found in parted. A heap-based buffer overflow can occur when processing a specially crafted FAT32 filesystem due to an integer calculation error during buffer allocation. A local attacker could exploit this by enticing a user or automated service to open a malicious filesystem image,...

CVE-2026-17591: Use After Free

A flaw was found in libarchive. An attacker can cause a Denial of Service DoS or potential information disclosure due to a use-after-free vulnerability, which occurs when a program reads memory that has already been released. This issue arises when the archiveentrycopymacmetadata function...

CVE-2026-111802: Improper Link Resolution Before File Access

A flaw was found in Nautilus. When a removable drive or disk image is unmounted or ejected, Nautilus prompts the user to empty the trash without verifying whether the trash directory paths are symbolic links. An attacker can exploit this flaw by tricking a user into mounting a crafted storage...

CVE-2026-107346: Undefined Security Weakness

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-106549: Undefined Security Weakness

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-96628: Incorrect Authorization

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.11.0, AuthMiddleware.managerAuth accepts X-Arcane-Agent-Token credentials and the environment-token branch calls next before the AdminRequired option is evaluated. An attacker with a valid...

CVE-2026-96627: Incorrect Privilege Assignment

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.6.0, UpdateUser in backend/api/handlers/users.go sets PasswordHash for any target without comparing caller and target privilege. A holder of delegated users:update permission can submit a password...

CVE-2026-96626: Exposure of Sensitive Information to an Unauthorized Actor

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 2.5.0, UpdateRegistry and TestRegistry in backend/api/services/containerregistryservice.go allow the registry URL to change while preserving the stored encrypted token. When a holder of registries:updat...

CVE-2026-68498: Uncontrolled Resource Consumption

StreamReadConstraints.maxNameLength default 50,000 characters is intended to bound how much memory a single JSON Object property name can consume while being parsed, independently of the much larger maxStringLength default 100,000,000 characters that bounds ordinary string values. For parsers bui...

CVE-2026-62438: Integer Overflow or Wraparound

A flaw was found in GIMP. An attacker can cause a Denial of Service DoS or potentially disclose sensitive memory contents by convincing a user to open or preview a specially crafted Bohemia Interactive PAA texture file. Due to an integer overflow when calculating image dimensions during file...

CVE-2026-49410: Cross-Site Request Forgery (CSRF)

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Versions before 0.56.0 allow cross-site request forgery against the unauthenticated GET /auth/telegram loopback callback because telegramauthhandler consumes an attacker-supplied one-time Telegram login...

CVE-2026-111044: Incorrect Authorization

Sunshine is a self-hosted game stream host for Moonlight. From 2026.329.165800 until 2026.906.222525, Sunshine accepted any client certificate that chained to a stored paired-client certificate, but it did not require the presented certificate to be the exact enabled paired identity. Certificate...

CVE-2026-108372: Origin Validation Error

Open and provider-neutral, LoopX is a lightweight state kernel and local-first control plane for loop engineering. From version 0.0.1 until 0.4.5, loopx serve-status in loopx/statusserver.py uses StatusRequestHandler.sendjson and doOPTIONS to send Access-Control-Allow-Origin: for unauthenticated...

CVE-2026-62439: Integer Overflow or Wraparound

A flaw was found in GIMP. An integer overflow occurs in the file-pvr plug-in when calculating memory buffer sizes for image dimensions. By tricking a user into opening or previewing a specially crafted PowerVR .pvr file, an attacker can trigger a heap-based buffer overflow, potentially leading to...

CVE-2026-96542: Incorrect Permission Assignment for Critical Resource

Incorrect permission assignment CWE-732 in the standalone installer for EA Javelin Anticheat versions 1.0.14329371, 1.0.14547437, 1.0.14789537, and 1.0.14940698 on Windows allows a local non-administrative user to elevate privileges to NT AUTHORITY\SYSTEM by modifying the EAAntiCheatService servi...

CVE-2026-64862: Missing Authorization

Frappe HR is an open-source human resources management solution HRMS. Prior to 15.58.3 and 16.4.3, HRMS PWA API endpoints for employee data do not consistently authorize employee-specific PWA API requests. An authenticated user requests records associated with another employee. The user can reque...

CVE-2026-55796: Improper Neutralization of Special Elements used in an SQL Command

Frappe HR is an open-source human resources management solution HRMS. Prior to 15.60.3 and 16.7.1, the Salary Payments via ECS report constructs report conditions with unsafe SQL string interpolation. An authenticated HR user supplies crafted Salary Payments via ECS report filter values. The...

CVE-2026-108374: Missing Authorization

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.121.0 and 16.34.0, certain endpoints for status modification fail to enforce proper authorization checks. A low-privileged authenticated user can invoke state-changing whitelisted methods without required write,...

CVE-2026-108373: Missing Authorization

ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.118.0 and 16.27.0, certain endpoints in the Sales Person-wise Transaction Summary report fail to enforce proper authorization checks. When a role-limited authenticated user requests the affected financial report, the...

CVE-2026-96620: Improper Input Validation

Claude Agent SDK is a Python SDK for Claude Code. Prior to 0.2.121, the resume option is passed to the Claude CLI as a separate token without validation, so a dash-leading value is parsed as an independent CLI flag. An attacker can inject the --mcp-config flag to define a stdio MCP server, causin...

CVE-2026-61726: Improper Access Control

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.12, StepViewSet and IngredientViewSet filter only by active Space and use role-level CustomIsUser checks instead of the private-recipe owner or sharing predicate when an authenticated...

CVE-2026-59970: Server-Side Request Forgery (SSRF)

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, passes an administrator-controlled AI provider URL directly to LiteLLM without applying the server's outbound-request SSRF checks when an authenticated user creates a Space,...

CVE-2026-59966: Inefficient Regular Expression Complexity

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, executes user-controlled Automation regular-expression patterns with Python re.sub without complexity validation or an execution timeout when an authenticated user stores a...

CVE-2026-59963: Authorization Bypass Through User-Controlled Key

Tandoor Recipes is an application for managing recipes, planning meals, and building shopping lists. Prior to 2.6.10, recipe utility endpoints retrieve same-Space Recipe objects without invoking the private-recipe owner or sharing permission when an authenticated member of a shared Space supplies...

CVE-2026-30971: Improper Neutralization of Special Elements used in an OS Command

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.39.2, 1.38.2, and 1.36.40, ZoneMinder interpolates an unvalidated monitor Device field into shell commands in PHP and Perl control paths when an authenticated user with monitor-create or monitor-edit...

CVE-2026-102834: Integer Overflow or Wraparound

JavaCV provides Java interfaces to OpenCV, FFmpeg, and other multimedia libraries. Prior to 1.5.14, IPCameraFrameGrabber doubles a 32-bit buffer capacity without checking for overflow or bounding the parsed Content-Length. An application consumes an MJPEG response from a malicious camera endpoint...

CVE-2026-102608: Improper Neutralization of Special Elements used in an OS Command

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, downloadEvents manually wraps a monitor Name value in single quotes instead of using escapeshellarg before placing it in shell commands when a user with monitor-create or monitor-edit permission...

CVE-2026-102607: Improper Neutralization of Special Elements used in an OS Command

ZoneMinder is a free, open source closed-circuit television software application. Prior to 1.38.3, the exportEvents function concatenates the attacker-controlled exportFile request parameter into a shell command without neutralizing shell metacharacters when an authenticated user with View Events...

CVE-2026-85977: Excessive Platform Resource Consumption within a Loop

A flaw was found in libtirpc. A remote attacker can exploit this vulnerability by sending specially crafted PMAPPROCDUMP replies to a client application that uses the pmapgetmaps function against an attacker-controlled host. This unbounded decoding can lead to excessive memory and CPU allocation,...

CVE-2026-85231: Allocation of Resources Without Limits or Throttling

A flaw was found in libtirpc. An authenticated remote attacker could exploit this vulnerability by sending oversized wrapped data requests to an RPC Remote Procedure Call service configured with RPCSECGSS Remote Procedure Call Security-Generic Security Service integrity or privacy. This can lead ...

CVE-2026-17491: Improper Privilege Management

IBM i 7.3, 7.4, 7.5, and 7.6 is could allow a remote authenticated attacker to bypass security restrictions due to improper enforcement of the ChrootDirectory configuration directive...

CVE-2026-17275: Improper Authorization

IBM i 7.3, 7.4, 7.5, and 7.6 could allow a remote attacker to perform unauthorized manipulation of distributed transactions due to improper validation of attacker-supplied transaction identifiers...