CVE-2026-88983

A flaw was found in Kubeflow Pipelines. The API server does not restrict destination addresses when fetching caller-supplied URLs during pipeline or pipeline-version creation. An authenticated user with pipeline creation privileges can exploit this Server-Side Request Forgery SSRF vulnerability t...

CVE-2026-88982

A flaw was found in Kubeflow Pipelines. The execution cache service generates cache keys without including the Kubernetes namespace, allowing cached data to be accessed across tenant boundaries. In multi-tenant environments sharing the cache service, an authenticated user with workload submission...

CVE-2026-112908

A flaw was found in filelock. When creating strict file locks on POSIX-compliant systems, coordination and claim directories are created without applying the caller's restrictive file permission settings. In environments with permissive file creation masks or default access control lists ACLs, a...

CVE-2026-92694

A flaw was found in FastNetMon. A remote attacker could trigger a race condition—a timing conflict where multiple operations access shared data simultaneously—resulting in a Denial of Service DoS. When processing network traffic within monitored IPv6 ranges, the application updates internal traff...

CVE-2026-88979

A flaw was found in Kubeflow Pipelines. The TensorBoard proxy relies on a publicly known default secret key to sign authentication tokens. In deployments where authorization is disabled, an unauthenticated remote attacker can forge authentication tokens to query internal cluster services on port ...

CVE-2026-123017

A flaw was found in GodotSteam. The multiplayer networking component fails to validate peer identification numbers provided during initial connection handshakes, allowing a connected player to claim the designated server identity. A remote attacker participating in a multiplayer session can explo...

CVE-2026-97045

A flaw was found in golang.org/x/net/html. This vulnerability allows a remote attacker to conduct Cross-Site Scripting XSS attacks by supplying specially crafted HTML markup. The renderer fails to properly verify namespace transitions for elements foster-parented across foreign namespaces,...

CVE-2026-120454

A flaw was found in sleuthkit. An attacker can cause a Denial of Service DoS by providing a specially crafted HFS+ filesystem image with an excessively large uncompressed attribute size. When sleuthkit attempts to decompress the data, a memory allocation failure triggers a null pointer dereferenc...

CVE-2026-88985

A flaw was found in Kubeflow Pipelines, which can lead to information disclosure. An authenticated remote attacker with permissions to list pipelines or runs can exploit this vulnerability by submitting a crafted pagination token containing manipulated database query fields. Because the API serve...

CVE-2026-111753

A flaw was found in @angular/common. Due to discrepancies between internal URL validation and browser URL parsing standards, outgoing requests to external destinations can be misclassified as same-origin requests. A remote attacker who induces an application to send a request to an...

CVE-2026-110390

A flaw was found in FlexNet Beacon. Due to missing authentication when anonymous web server access is enabled, an unauthenticated remote attacker can exploit this issue to cause information disclosure. An attacker can connect to the service without credentials to retrieve sensitive Beacon policy...

CVE-2026-106716

A flaw was found in ReelShort. A remote attacker could obtain sensitive user metadata and credentials by tricking a user into opening a crafted deep link. The application renders attacker-supplied web addresses in an internal web browser view without properly validating the origin, permitting...

CVE-2026-113368

A flaw was found in Sonatype Nexus Repository. This vulnerability allows an authenticated attacker with privileges to add or edit group repositories to bypass access controls, leading to information disclosure. Because the application does not verify whether an account is authorized to access an...

CVE-2026-123199

A flaw was found in ebook-speaker. An attacker can cause a Denial of Service DoS by convincing a user to open a specially crafted digital book file, such as an EPUB or DAISY document. Due to missing length validation when parsing an element's name attribute, the application experiences a stack...

CVE-2026-122330

A flaw was found in c-blosc2. This vulnerability allows an attacker to cause a Denial of Service DoS by providing a specially crafted compressed data frame containing zero chunk or block size values. When an application attempts to read a data slice from the malicious frame, an unhandled...

CVE-2026-76181

A flaw was found in LibreOffice. The application's dBASE database driver fails to validate entry counts against page capacity and does not prevent circular page references when parsing index .ndx files. By convincing a user to open a data source with a specially crafted dBASE index file, an...

CVE-2026-94395

A flaw was found in SafeNet Authentication Client SAC. A stack-based buffer overflow vulnerability in the SIS token engine allows an attacker connecting a malicious physical or software-emulated smart card to execute arbitrary code with the privileges of the affected process. This flaw occurs...

CVE-2026-58128

A flaw was found in Alan: Health Insurance for Android. This vulnerability allows a local malicious application on the same device to achieve arbitrary code execution or tamper with application data by overwriting sensitive files in the application's private storage. An attacker can exploit this...

CVE-2026-111770

A flaw was found in @modelcontextprotocol/server. When a Model Context Protocol MCP server handling HTTP traffic reuses a single server or transport instance across multiple connections, messages are matched solely using request identifiers that frequently collide. A remote client can trigger or...

CVE-2026-82029

A flaw was found in Invoice Ninja. An authenticated vendor portal user can gain unauthorized access to documents belonging to other vendors and clients due to improper authorization checks that only validate company-level scope rather than specific vendor ownership. By supplying or enumerating...

CVE-2026-76806

A flaw was found in solidtime. An authenticated remote attacker can exploit this vulnerability by uploading a specially crafted archive file containing directory traversal sequences during a Toggl data import. Successful exploitation allows the attacker to bypass directory restrictions, create...

CVE-2026-122309

A flaw was found in Kyverno. This vulnerability allows an authorized user with policy creation permissions to cause a Denial of Service DoS by submitting Common Expression Language CEL expressions that are evaluated without runtime computational limits. By creating policies with resource-intensiv...

CVE-2026-122020

A flaw was found in Nstbrowser. A remote attacker could exploit this vulnerability by sending a crafted request to the stopAll API endpoint within the Local Agent Management Service. Successful exploitation allows the attacker to terminate active browser instances, resulting in a Denial of Servic...

CVE-2026-123010

A flaw was found in @twilio-labs/netlify-okta-auth. An unauthenticated remote attacker could bypass authentication or cause server-side request forgery by supplying a forged security token. The application trusts an unverified issuer iss claim within incoming tokens when sending outbound HTTP...

CVE-2026-122116

A flaw was found in Yealink terminal devices. An improper access control vulnerability in the Wi-Fi 802.1X Protected Extensible Authentication Protocol PEAP configuration allows unauthorized users to access network settings without administrative privileges. An attacker can exploit this issue to...

CVE-2026-122314

A flaw was found in Kyverno. An attacker authorized to submit resources can cause a Denial of Service DoS by providing unexpected non-string data in fields evaluated by policy variable substitutions. Because the variable-substitution engine fails to properly verify data types, processing this inp...

CVE-2026-121746

A flaw was found in Node Version Manager nvm. When saving a version configuration, nvm follows symbolic links without verifying whether the target file resides outside the working directory. By convincing a user to execute save commands within a malicious repository containing a crafted symbolic...

CVE-2026-119746

A flaw was found in ICX35. The integrated web interface enforces account lockout restrictions against repeated failed authentication attempts using client-side code rather than validating them on the server. A remote attacker can bypass this lockout protection by clearing browser cookies, enablin...

CVE-2026-121968

A flaw was found in netrek-client-cow. An attacker controlling a server or intercepting network traffic can trigger an out-of-bounds read by sending a specially crafted message containing an invalid recipient index. This issue causes the client application to crash, resulting in a Denial of Servi...

CVE-2026-111771

A flaw was found in the Model Context Protocol MCP TypeScript SDK. The server-side authentication mechanism fails to verify that incoming access tokens were specifically issued for the target server. A remote attacker with a valid token issued for another service within the same authorization...

CVE-2026-106715

A flaw was found in NewsBreak. This vulnerability allows for information disclosure because the application improperly trusts data URLs during internal web browser WebView origin validation. By tricking a user into opening a crafted deep link, a remote attacker can invoke internal interface...

CVE-2026-118517

A flaw was found in the Symfony HtmlSanitizer component. Due to differences in how URLs are parsed compared to web browsers, the component fails to properly detect hosts in certain malformed URLs when host allowlists are enforced. A remote attacker can exploit this vulnerability by submitting...

CVE-2026-112072

A flaw was found in vault-java-driver. The driver's internal JSON parser does not enforce a limit on nesting depth when processing server responses. An authenticated user with write permissions to a Vault path can store deeply nested data, which triggers a stack overflow during parsing and...

CVE-2026-75615

A flaw was found in ASN1SCC. The runtime and generated string decoders fail to properly validate decoded character indices against the allowed character set before memory access. A remote attacker could exploit this vulnerability by sending a specially crafted message, triggering an out-of-bounds...

CVE-2026-81190

A flaw was found in KurrentDB. An authenticated user authorized to read event streams can abuse secondary indexing query functionality to read arbitrary files accessible to the database service. This issue also allows the user to enumerate local directories and initiate unauthorized network...

CVE-2026-77463

A flaw was found in Remark42. The application trusts client-supplied HTTP forwarding headers to determine the client's IP address without verifying that requests originate from a trusted proxy. A remote attacker can exploit this vulnerability by sending spoofed IP headers, allowing them to bypass...

CVE-2026-62268

A flaw was found in borgbackup. This flaw allows arbitrary file overwrite, deletion, or information disclosure during archive extraction. The application fails to properly validate path targets, allowing symbolic links, directory traversal sequences, and external hard links to escape the target...

CVE-2026-123203

A flaw was found in NEURON. A local attacker can cause a Denial of Service DoS and stack memory corruption by convincing a user or system to load a specially crafted model dataset containing oversized tokens. When the application parses these malformed data files, a stack-based buffer overflow...

CVE-2026-123197

A flaw was found in wppconnect-server due to missing authentication on static file endpoints. An unauthenticated remote attacker can exploit this issue by enumerating timestamp-based file paths in requests to retrieve decrypted sticker media across sessions. This allows unauthorized access to...

CVE-2026-123201

A flaw was found in buku. This vulnerability allows an unauthenticated remote attacker to cause information disclosure through Server-Side Request Forgery SSRF due to improper URL validation in the bukuserver component. By supplying crafted web addresses to API endpoints, an attacker can coerce t...

CVE-2026-123125

A flaw was found in the Symfony Validator component. The IP address validator improperly classifies certain internal and reserved network addresses as public, such as shared address spaces and IPv6 addresses embedding internal IPv4 addresses. A remote attacker can exploit this flaw by submitting...

CVE-2026-122326

A flaw was found in Chevereto. An improper authorization check in the album listing endpoint allows an unauthenticated remote attacker to access private albums. By supplying an album identifier alongside a public session token, an attacker can retrieve image filenames, view direct file links, and...

CVE-2026-123094

A flaw was found in Huginn. The application improperly handles OAuth service display names, resulting in a stored cross-site scripting XSS vulnerability. An authenticated attacker can exploit this issue by registering an account with crafted display names or email addresses and sharing it globall...

CVE-2026-122126

A flaw was found in reSIProcate. This vulnerability allows a malicious server or an on-path network attacker to cause a denial of service DoS by crashing the reTurn client. By sending oversized network frames that exceed the allocated buffer size, an attacker triggers a heap-based buffer overflow...

CVE-2026-122189

A flaw was found in ppl.nn. An out-of-bounds read vulnerability in the CUDA optimizer allows a remote attacker to cause a Denial of Service DoS or disclose sensitive memory contents by providing manipulated quantization parameters. When the application processes crafted inputs during quantization...

CVE-2026-122159

A flaw was found in Audio8TTS. A remote attacker could exploit this vulnerability by supplying a manipulated path in the model configuration parameters, such as the slowdecodemodels argument during runtime initialization. This leads to path traversal, potentially allowing the attacker to access...

CVE-2026-121959

A flaw was found in FreeRDP. A malicious Remote Desktop RD Gateway or network attacker can cause a Denial of Service DoS by sending a truncated WebSocket data frame followed by a Transport Layer Security TLS connection shutdown. Due to improper handling of the incomplete payload when the connecti...

CVE-2026-122148

A flaw was found in the MeetingBoard web management module. An authenticated administrator on the local network can bypass client-side interface controls by directly modifying the web page Document Object Model DOM. By circumventing these front-end restrictions, an attacker can invoke restricted...

CVE-2026-54442

A flaw was found in Emissary. The application fails to properly validate navigation links, accepting protocol-relative and malformed web addresses. An attacker with privileges to configure navigation links can exploit this flaw to redirect users to arbitrary external websites an open redirect or...

CVE-2026-122054

A flaw was found in glibc. When converting crafted text using the BIG-HKSCS character set, such as through the iconv library function, the conversion routine can fail to advance and enter an infinite loop. A remote attacker could exploit this vulnerability by submitting malicious input to an...