Red Hat: CVE-2026-87864: curl: IMAP APPEND plus CRLF conversion command injection

Enabling CURLOPTCRLF causes curl to advertise the raw input byte count in the IMAP APPEND N literal while transmitting line-ending expanded data. The server reads only $N$ bytes for the payload, causing the remaining overflow bytes to be interpreted and executed as pipelined IMAP commands within...

Ubuntu: USN-8927-1 (CVE-2026-92386): curl vulnerabilities

When writing a long cookie name and value to a Netscape cookie jar, a remote HTTP server can make curl write a record that exceeds its line-length parsing limit. Consequently, any subsequent curl invocation reading from that same cookie jar using --cookie silently aborts parsing prematurely upon...

Red Hat: CVE-2026-92388: curl: curl: FTP wildcard write callback mixup

When an FTP wildcard LIST operation fails, libcurl omits the restoration path meant for successful listings, leaving the write callback set to the internal listing parser and the write callback data pointing directly to the easy handle. Subsequent reuse of this handle triggers an immediate crash,...

Red Hat: CVE-2026-92391: curl: curl: curl_mime_free stack overflow by recursion

A deeply nested multipart MIME structure constructed via the public API causes a stack overflow in libcurl during normal cleanup operations. An excessive recursion depth within curlmimefree leads to unbounded stack frame allocation during structure traversal, ultimately crashing the host process...

Ubuntu: USN-8927-1 (CVE-2026-87865): curl vulnerabilities

When libcurl uses libssh2 with a hashed knownhosts file, an unrelated initial entry can cause host key validation to report a key mismatch as a missing key to the CURLOPTSSHKEYFUNCTION callback...

Debian: CVE-2026-92162: flatpak -- security update

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured most common on Fedora systems, a malicious local user in an active local session could use a crafted architecture na...

Ubuntu: USN-8927-1 (CVE-2026-86410): curl vulnerabilities

A flaw in the curl command line tool's logic makes it only set SSH host verification options when interacting directly using SFTP or SCP, and not as a result of following a redirect...

Ubuntu: USN-8927-1 (CVE-2026-107928): curl vulnerabilities

When curl is built with GnuTLS, a malicious WebSocket server can make curl send memory past its send buffer. This is due to an out of bounds read following when gnutlsrecordsend returns a number of bytes sent greater than the number of bytes it was given to send. GnuTLS does that after a blocked...

Ubuntu: (Multiple Advisories) (CVE-2026-87862): curl vulnerabilities

Importing a includeSubDomains parent HSTS entry before a longer-lived child entry, silently drops the child. Consequently, when the parent expires, the child's valid HSTS policy is lost, causing curl to issue unencrypted HTTP requests rather than upgrading to HTTPS...

Ubuntu: USN-8927-1 (CVE-2026-92387): curl vulnerabilities

By permanently omitting the final control-response line, a malicious FTP, IMAP, POP3, or SMTP server can exploit libcurl and completely bypass its configured transfer timeout mechanism, indefinitely blocking all concurrent transfers bound to the same multi-handle...

Red Hat: CVE-2026-94266: curl: curl: password leak in CURLINFO_EFFECTIVE_URL

libcurl could accidentally return a URL for curleasygetinfo's CURLINFOEFFECTIVEURL option containing credentials, even though neither the URL provided to libcurl nor the redirected URL did...

Ubuntu: USN-8927-1 (CVE-2026-86412): curl vulnerabilities

A remote HTTP server can set a cookie that curl accepts and writes to a Netscape cookie jar but cannot reload. On the next invocation using the same path for --cookie and --cookie-jar, curl fails before connecting, then the cleanup procedure replaces the jar with an empty file, deleting cookies f...

Ubuntu: USN-8927-1 (CVE-2026-107929): curl vulnerabilities

When CURLOPTINTERFACE or the command line tool's --interface option is set with one of the documented prefixes if!, host!, ifhost!, that binding is not part of the connection reuse key, so a later transfer asking for a different source can silently reuse an existing connection and go out from the...

Red Hat: CVE-2026-86414: curl: curl: leaking host credentials to HTTP proxy

An HTTP proxy can trick libcurl into sending the origin's credentials Basic password, or a Negotiate/Kerberos ticket to the proxy itself, by answering the CONNECT tunnel request with 401 WWW-Authenticate: instead of the expected 407 Proxy-Authenticate:...

Red Hat: CVE-2026-92390: curl: curl: -J no-clobber guarantee bypassed with 103 early hints

When invoked with --remote-header-name -J, curl fails to preserve its documented anti-clobbering protection if an intermediate 103 Early Hints response precedes the final HTTP response, or if an ETag header is processed before Content-Disposition under --etag-save. This flaw allows an HTTPS serve...

Red Hat: CVE-2026-92389: curl: curl: TFTP direction confusion

libcurl's TFTP state machine fails to validate state transitions against the requested transfer direction, accepting opening server responses for both reads and writes interchangeably. A malicious TFTP server can respond to a download request in a way that forces the client into transmit mode,...

Red Hat: CVE-2026-86409: curl: curl: stale SigV4 headers sent unintended

Setting CURLOPTAWSSIGV4 to NULL but does not disable SigV4 authentication, contrary to expectations and documentation. A subsequent transfer on the same handle still sends an Authorization: AWS4-HMAC-SHA256 header to whatever URL isset next, leaking state information...

Red Hat: CVE-2026-87863: curl: curl: Hsts Response Erases Persisted Entries

An authenticated HTTPS origin can supply an HSTS max-age value that the parser accepts, but time serialization later fails to process. On 64-bit systems, extreme max-age values compute an absolute expiry within standard time integer limits that exceeds calendar time structure bounds. During cache...

CVE-2026-103311: Insufficient Verification of Data Authenticity

The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin through 1.4.1 does not verify the authenticity of incoming payment webhook notifications, because the shared secret used to validate the request signature is empty by default and nothing rejects an unconfigured secret, allowin...

CVE-2026-71170: Uncontrolled Search Path Element

Dell Application Store, versions prior to 26.05.0.7, contains an Uncontrolled Path Element vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to an Elevation of Privilege and arbitrary code execution...

CVE-2026-110673: Uncontrolled Recursion

Cpanel::JSON::XS versions before 4.80 for Perl allow stack exhaustion via nested tagged values under allowtags in decodetag. With allowtags, "" starts a tagged value. Its tag and value are decoded recursively, and each can start another tagged value. Unlike arrays and objects, this nesting is not...

CVE-2026-91858: Improper Restriction of XML External Entity Reference

FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance and enabling only FEATURESECUREPROCESSING before running an identity transform over the body. On the JDK's built-in transformer, that feature alone...

CVE-2026-110686: Use After Free

Cpanel::JSON::XS versions before 4.80 for Perl use freed filter callbacks when a filter removes itself during decoding in decodehv. A decode copies the parser's filterjsonobject and filterjsonsinglekeyobject callbacks without taking references to them. A filter callback that removes the last...

CVE-2026-112076: Server-Side Request Forgery (SSRF)

A security vulnerability has been detected in alexta69 MeTube up to 2026.09.28. This vulnerability affects the function DownloadQueue.writefeedmetadatasync of the file app/ytdl.py of the component Feed-metadata Thumbnail Fetch Handler. Such manipulation leads to server-side request forgery. The...

CVE-2026-111936: Server-Side Request Forgery (SSRF)

Sigma File Manager through 2.2.0 contains a server-side request forgery vulnerability because validateremoteurl in security.rs never checks resolved IP addresses for extension download commands. A malicious extension or catalog entry can use hostnames resolving to loopback, private, or cloud...

CVE-2026-112252: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability has been found in Wuxi Wubang Security Software Wubang Five-in-One Safety Production Management Information System up to 3.5. Affected is the function xpcmdshell of the file /ws.asmx. The manipulation of the argument sql leads to sql injection. The attack may be initiated remotely...

CVE-2026-112101: Origin Validation Error

A vulnerability was determined in BlackBeltTechnology pi-agent-dashboard up to 0.8.0. The affected element is an unknown function of the file /BlackBeltTechnology/pi-agent-dashboard of the component WebSocket Gateway. Executing a manipulation of the argument cwd can lead to origin validation erro...

CVE-2026-112102: Improper Control of Generation of Code

A vulnerability was detected in AXA Group NLP.js 4.27.0. This impacts the function Evaluator.walkFunction of the file packages/evaluator/src/evaluator.js of the component Condition Expression Pipeline. The manipulation of the argument condition results in code injection. It is possible to launch...

CVE-2026-111831: Missing Authorization

Missing Authorization vulnerability in WP ManageNinja LLC FluentForm fluentform allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 6.2.15...

CVE-2026-12148: Deserialization of Untrusted Data

IBM MQ Operator could allow an authenticated attacker to cause a denial of service or potentially execute arbitrary code due to unrestricted Java deserialization in the MQ Classes for Java...

CVE-2026-112283: Memory Allocation with Excessive Size Value

VideoLAN libbluray through 1.5.1 contains an uncontrolled memory allocation vulnerability in parseextentstartpoints in clpiparse.c that trusts the numpoint field without bounds checking. Attackers can supply a crafted .clpi file on a disc, image, or directory with a huge numpoint to exhaust memor...

CVE-2026-11319: Improper Limitation of a Pathname to a Restricted Directory

TickTick Android application com.ticktick.task 8.2.2.0 contains a path traversal vulnerability in its exported ShareReceiveActivity that allows a malicious local application to write files outside the intended attachment directory by supplying a crafted content:// URI with a traversal filename vi...

CVE-2026-85251: Exposure of Sensitive Information to an Unauthorized Actor

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Two paths handed credentials to a redirect target, which is a host chosen by the remote server rather than...

CVE-2025-55667: Improper Restriction of Operations within the Bounds of a Memory Buffer

A segmentation violation in the dumpisomsaps function /mp4box/filedump.c of GPAC MP4Box v2.5-DEV-rev1672-gc9a31d0e1-masterallows attackers to cause a Denial of Service DoS via supplying a crafted MP4 file...

CVE-2026-112032: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was identified in aircheng-org iWebShop-5 up to 5.16. Impacted is the function Util::search of the file classes/util.php. The manipulation leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. The project was...

CVE-2026-112091: Exposure of Sensitive Information to an Unauthorized Actor

A flaw has been found in Dav-ee dairy-management-system 31ace9692d1e1e6d64339a42c463b361319c615c/f31a584c3330c013b61f8b0306d9e0849c6d693d. Impacted is an unknown function of the file delivery/checkfarmer.json.php of the component AJAX Endpoint. This manipulation of the argument fname causes...

CVE-2026-112081: Deserialization of Untrusted Data

A vulnerability was determined in hankcs HanLP up to 2.1.0-beta.64. This affects the function hanlp.load of the file plugins/hanlpcommon/hanlpcommon/reflection.py of the component Model Config Loading. This manipulation of the argument classpath causes deserialization. It is possible to initiate...

CVE-2026-112285: Improper Enforcement of a Single, Unique Action

Thelia before 3.1.5 and 3.2.x before 3.2.4 contains a business logic vulnerability that allows authenticated customers to bypass coupon usage limits because usage is counted only when orders become paid. Attackers can place multiple pay-later orders while a usage remains, or cancel paid orders to...

CVE-2026-110675: Improper Validation of Syntactic Correctness of Input

Cpanel::JSON::XS versions from 4.33 before 4.80 for Perl accept malformed UTF-8 in bare hash keys under allowbarekey in decodehv. With utf8 and allowbarekey, which relaxed enables, a quoted key is validated as UTF-8 but a bare key's bytes are stored as a UTF-8 flagged string without any check...

CVE-2026-94272: Missing Authorization

The Snap Finance WordPress plugin before 3.12.0 does not verify that a request to change a WooCommerce order's status comes from an authorised source, allowing unauthenticated attackers to move any order into a paid state or force it to fail...

CVE-2026-94229: Authorization Bypass Through User-Controlled Key

The TrueBooker WordPress plugin before 1.3.0 does not verify that the requester owns a booking before rendering its confirmation summary, allowing unauthenticated attackers to enumerate booking identifiers and retrieve the personal information of customers who booked an appointment, as well as...

CVE-2026-11831: Heap-based Buffer Overflow

IBM MQ could allow an authenticated attacker to cause a limited denial of service and obtain very limited information about process memory layout due to an out-of-bounds read when processing a specially crafted client request...

CVE-2026-112092: Improper Neutralization of Input During Web Page Generation

A flaw has been found in subhajitkhan online-clinic-management-system up to e9ee77a8827a1446220fa07ee693dc4d9a29a578. The affected element is the function echo of the file doctorregistration.php of the component Doctor Registration. Executing a manipulation of the argument docname can lead to cro...

CVE-2026-14511: Allocation of Resources Without Limits or Throttling

IBM MQ 9.4.5.0 through 9.4.5.1 could allow an authenticated user to cause a denial of service by sending a specially crafted message that crashes consuming applications...

CVE-2026-108764: Server-Side Request Forgery (SSRF)

Server-Side request forgery SSRF vulnerability in Apache Kylin. Impact most to the kylin job service that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommend...

CVE-2026-112138: Improper Limitation of a Pathname to a Restricted Directory

A flaw has been found in diem-project diem up to 5.1.3. The impacted element is the function dmOs::join of the file dmFrontPlugin/modules/dmCodeEditor/actions/actions.class.php of the component dmCodeEditor. Executing a manipulation can lead to path traversal. The attack can be launched remotely...

CVE-2025-7043: Missing Authorization

The ForgeRock client fails to correctly validate refresh tokens. This allows a refresh token to be treated as a valid access token, enabling its use for consuming protected resources. This bypasses the intended security control that requires valid client credentials in addition to a refresh token...

CVE-2026-112779: Allocation of Resources Without Limits or Throttling

Grav API plugin grav-plugin-api 1.0.40 before 1.0.42 caches a full translation dictionary for every well-formed language code sent to the unauthenticated GET /api/v1/translations/lang endpoint, and 1.0.16 before 1.0.42 fails to check target and destination page rules in the sync and batch copy...

CVE-2026-77225: Undefined Security Weakness

Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...

CVE-2026-85301: Improper Authentication

Improper Authentication vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0 before 4.22.1. The security processor validated the issuer of an introspected token only when the introspection response actually carried an iss claim...