CVE-2026-123655

A flaw was found in Moodle. Insufficient access control checks on H5P content files allow unauthenticated remote attackers to view restricted materials, including content stored in the system context and files belonging to hidden or unavailable course modules. This issue results in unauthorized...

CVE-2026-121819

A flaw was found in armeria-xds. This vulnerability can lead to information disclosure if a compromised or semi-trusted discovery service xDS control plane directs the client to read arbitrary files. Because the path validation mechanism in DataSourcePolicy fails to resolve symbolic links, files...

CVE-2026-89238

A flaw was found in Apache WSS4J. A remote attacker can exploit an element confusion issue in encrypted header processing by sending a specially crafted message. This vulnerability causes the application to treat an attacker-controlled plaintext element as a decrypted header, potentially leading ...

CVE-2026-87830

A flaw was found in Apache WSS4J. In the streaming security policy validator, specific XML Path Language XPath expressions can fail to resolve against actual message structures. A remote attacker can exploit this issue to bypass security policy checks by sending message elements that lack require...

CVE-2026-121820

A flaw was found in armeria-saml. The HTTP-Redirect binding decoder decompresses incoming Security Assertion Markup Language SAML messages without restricting the maximum uncompressed size before validating signatures. An unauthenticated remote attacker can exploit this issue by sending a special...

CVE-2026-95616

A flaw was found in Apache WSS4J. An unauthenticated remote attacker can cause a Denial of Service DoS by sending a crafted Simple Object Access Protocol SOAP message containing a digital certificate with an oversized extension length. Due to an integer overflow during certificate bounds checking...

CVE-2026-88799

A flaw was found in the MDJM Event Management and Mobile Events Manager WordPress plugins. The software fails to properly verify user permissions and ownership when processing client profile update requests. An authenticated user with low privileges can exploit this vulnerability by submitting...

CVE-2026-88983

A flaw was found in Kubeflow Pipelines. The API server does not restrict destination addresses when fetching caller-supplied URLs during pipeline or pipeline-version creation. An authenticated user with pipeline creation privileges can exploit this Server-Side Request Forgery SSRF vulnerability t...

CVE-2026-88982

A flaw was found in Kubeflow Pipelines. The execution cache service generates cache keys without including the Kubernetes namespace, allowing cached data to be accessed across tenant boundaries. In multi-tenant environments sharing the cache service, an authenticated user with workload submission...

CVE-2026-112908

A flaw was found in filelock. When creating strict file locks on POSIX-compliant systems, coordination and claim directories are created without applying the caller's restrictive file permission settings. In environments with permissive file creation masks or default access control lists ACLs, a...

CVE-2026-92694

A flaw was found in FastNetMon. A remote attacker could trigger a race condition—a timing conflict where multiple operations access shared data simultaneously—resulting in a Denial of Service DoS. When processing network traffic within monitored IPv6 ranges, the application updates internal traff...

CVE-2026-88979

A flaw was found in Kubeflow Pipelines. The TensorBoard proxy relies on a publicly known default secret key to sign authentication tokens. In deployments where authorization is disabled, an unauthenticated remote attacker can forge authentication tokens to query internal cluster services on port ...

CVE-2026-123017

A flaw was found in GodotSteam. The multiplayer networking component fails to validate peer identification numbers provided during initial connection handshakes, allowing a connected player to claim the designated server identity. A remote attacker participating in a multiplayer session can explo...

CVE-2026-88985

A flaw was found in Kubeflow Pipelines, which can lead to information disclosure. An authenticated remote attacker with permissions to list pipelines or runs can exploit this vulnerability by submitting a crafted pagination token containing manipulated database query fields. Because the API serve...

CVE-2026-97045

A flaw was found in golang.org/x/net/html. This vulnerability allows a remote attacker to conduct Cross-Site Scripting XSS attacks by supplying specially crafted HTML markup. The renderer fails to properly verify namespace transitions for elements foster-parented across foreign namespaces,...

CVE-2026-120454

A flaw was found in sleuthkit. An attacker can cause a Denial of Service DoS by providing a specially crafted HFS+ filesystem image with an excessively large uncompressed attribute size. When sleuthkit attempts to decompress the data, a memory allocation failure triggers a null pointer dereferenc...

CVE-2026-111753

A flaw was found in @angular/common. Due to discrepancies between internal URL validation and browser URL parsing standards, outgoing requests to external destinations can be misclassified as same-origin requests. A remote attacker who induces an application to send a request to an...

CVE-2026-110390

A flaw was found in FlexNet Beacon. Due to missing authentication when anonymous web server access is enabled, an unauthenticated remote attacker can exploit this issue to cause information disclosure. An attacker can connect to the service without credentials to retrieve sensitive Beacon policy...

CVE-2026-106716

A flaw was found in ReelShort. A remote attacker could obtain sensitive user metadata and credentials by tricking a user into opening a crafted deep link. The application renders attacker-supplied web addresses in an internal web browser view without properly validating the origin, permitting...

CVE-2026-113368

A flaw was found in Sonatype Nexus Repository. This vulnerability allows an authenticated attacker with privileges to add or edit group repositories to bypass access controls, leading to information disclosure. Because the application does not verify whether an account is authorized to access an...

CVE-2026-123199

A flaw was found in ebook-speaker. An attacker can cause a Denial of Service DoS by convincing a user to open a specially crafted digital book file, such as an EPUB or DAISY document. Due to missing length validation when parsing an element's name attribute, the application experiences a stack...

CVE-2026-122330

A flaw was found in c-blosc2. This vulnerability allows an attacker to cause a Denial of Service DoS by providing a specially crafted compressed data frame containing zero chunk or block size values. When an application attempts to read a data slice from the malicious frame, an unhandled...

CVE-2026-76181

A flaw was found in LibreOffice. The application's dBASE database driver fails to validate entry counts against page capacity and does not prevent circular page references when parsing index .ndx files. By convincing a user to open a data source with a specially crafted dBASE index file, an...

CVE-2026-94395

A flaw was found in SafeNet Authentication Client SAC. A stack-based buffer overflow vulnerability in the SIS token engine allows an attacker connecting a malicious physical or software-emulated smart card to execute arbitrary code with the privileges of the affected process. This flaw occurs...

CVE-2026-58128

A flaw was found in Alan: Health Insurance for Android. This vulnerability allows a local malicious application on the same device to achieve arbitrary code execution or tamper with application data by overwriting sensitive files in the application's private storage. An attacker can exploit this...

CVE-2026-111770

A flaw was found in @modelcontextprotocol/server. When a Model Context Protocol MCP server handling HTTP traffic reuses a single server or transport instance across multiple connections, messages are matched solely using request identifiers that frequently collide. A remote client can trigger or...

CVE-2026-82029

A flaw was found in Invoice Ninja. An authenticated vendor portal user can gain unauthorized access to documents belonging to other vendors and clients due to improper authorization checks that only validate company-level scope rather than specific vendor ownership. By supplying or enumerating...

CVE-2026-76806

A flaw was found in solidtime. An authenticated remote attacker can exploit this vulnerability by uploading a specially crafted archive file containing directory traversal sequences during a Toggl data import. Successful exploitation allows the attacker to bypass directory restrictions, create...

CVE-2026-122309

A flaw was found in Kyverno. This vulnerability allows an authorized user with policy creation permissions to cause a Denial of Service DoS by submitting Common Expression Language CEL expressions that are evaluated without runtime computational limits. By creating policies with resource-intensiv...

CVE-2026-122020

A flaw was found in Nstbrowser. A remote attacker could exploit this vulnerability by sending a crafted request to the stopAll API endpoint within the Local Agent Management Service. Successful exploitation allows the attacker to terminate active browser instances, resulting in a Denial of Servic...

CVE-2026-123010

A flaw was found in @twilio-labs/netlify-okta-auth. An unauthenticated remote attacker could bypass authentication or cause server-side request forgery by supplying a forged security token. The application trusts an unverified issuer iss claim within incoming tokens when sending outbound HTTP...

CVE-2026-122116

A flaw was found in Yealink terminal devices. An improper access control vulnerability in the Wi-Fi 802.1X Protected Extensible Authentication Protocol PEAP configuration allows unauthorized users to access network settings without administrative privileges. An attacker can exploit this issue to...

CVE-2026-122314

A flaw was found in Kyverno. An attacker authorized to submit resources can cause a Denial of Service DoS by providing unexpected non-string data in fields evaluated by policy variable substitutions. Because the variable-substitution engine fails to properly verify data types, processing this inp...

CVE-2026-121746

A flaw was found in Node Version Manager nvm. When saving a version configuration, nvm follows symbolic links without verifying whether the target file resides outside the working directory. By convincing a user to execute save commands within a malicious repository containing a crafted symbolic...

CVE-2026-119746

A flaw was found in ICX35. The integrated web interface enforces account lockout restrictions against repeated failed authentication attempts using client-side code rather than validating them on the server. A remote attacker can bypass this lockout protection by clearing browser cookies, enablin...

CVE-2026-121968

A flaw was found in netrek-client-cow. An attacker controlling a server or intercepting network traffic can trigger an out-of-bounds read by sending a specially crafted message containing an invalid recipient index. This issue causes the client application to crash, resulting in a Denial of Servi...

CVE-2026-111771

A flaw was found in the Model Context Protocol MCP TypeScript SDK. The server-side authentication mechanism fails to verify that incoming access tokens were specifically issued for the target server. A remote attacker with a valid token issued for another service within the same authorization...

CVE-2026-106715

A flaw was found in NewsBreak. This vulnerability allows for information disclosure because the application improperly trusts data URLs during internal web browser WebView origin validation. By tricking a user into opening a crafted deep link, a remote attacker can invoke internal interface...

CVE-2026-118517

A flaw was found in the Symfony HtmlSanitizer component. Due to differences in how URLs are parsed compared to web browsers, the component fails to properly detect hosts in certain malformed URLs when host allowlists are enforced. A remote attacker can exploit this vulnerability by submitting...

CVE-2026-112072

A flaw was found in vault-java-driver. The driver's internal JSON parser does not enforce a limit on nesting depth when processing server responses. An authenticated user with write permissions to a Vault path can store deeply nested data, which triggers a stack overflow during parsing and...

CVE-2026-75615

A flaw was found in ASN1SCC. The runtime and generated string decoders fail to properly validate decoded character indices against the allowed character set before memory access. A remote attacker could exploit this vulnerability by sending a specially crafted message, triggering an out-of-bounds...

CVE-2026-81190

A flaw was found in KurrentDB. An authenticated user authorized to read event streams can abuse secondary indexing query functionality to read arbitrary files accessible to the database service. This issue also allows the user to enumerate local directories and initiate unauthorized network...

CVE-2026-77463

A flaw was found in Remark42. The application trusts client-supplied HTTP forwarding headers to determine the client's IP address without verifying that requests originate from a trusted proxy. A remote attacker can exploit this vulnerability by sending spoofed IP headers, allowing them to bypass...

CVE-2026-62268

A flaw was found in borgbackup. This flaw allows arbitrary file overwrite, deletion, or information disclosure during archive extraction. The application fails to properly validate path targets, allowing symbolic links, directory traversal sequences, and external hard links to escape the target...

CVE-2026-123203

A flaw was found in NEURON. A local attacker can cause a Denial of Service DoS and stack memory corruption by convincing a user or system to load a specially crafted model dataset containing oversized tokens. When the application parses these malformed data files, a stack-based buffer overflow...

CVE-2026-123197

A flaw was found in wppconnect-server due to missing authentication on static file endpoints. An unauthenticated remote attacker can exploit this issue by enumerating timestamp-based file paths in requests to retrieve decrypted sticker media across sessions. This allows unauthorized access to...

CVE-2026-123201

A flaw was found in buku. This vulnerability allows an unauthenticated remote attacker to cause information disclosure through Server-Side Request Forgery SSRF due to improper URL validation in the bukuserver component. By supplying crafted web addresses to API endpoints, an attacker can coerce t...

CVE-2026-123125

A flaw was found in the Symfony Validator component. The IP address validator improperly classifies certain internal and reserved network addresses as public, such as shared address spaces and IPv6 addresses embedding internal IPv4 addresses. A remote attacker can exploit this flaw by submitting...

CVE-2026-122326

A flaw was found in Chevereto. An improper authorization check in the album listing endpoint allows an unauthenticated remote attacker to access private albums. By supplying an album identifier alongside a public session token, an attacker can retrieve image filenames, view direct file links, and...

CVE-2026-123094

A flaw was found in Huginn. The application improperly handles OAuth service display names, resulting in a stored cross-site scripting XSS vulnerability. An authenticated attacker can exploit this issue by registering an account with crafted display names or email addresses and sharing it globall...