CVE-2026-115295 Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with read access to connectors in one Kibana space can retrieve connector execution log information fro...

CVE-2026-115294 Improper Limitation of a Pathname to a Restricted Directory in Kibana Leading to Unauthorized Resource Deletion

Improper Limitation of a Pathname to a Restricted Directory CWE-22 in the Kibana Fleet feature can lead to unauthorized resource deletion via Path Traversal CAPEC-126. A low-privileged user with Fleet agent policies write access could cause a subsequent administrative action to act on unintended...

CVE-2026-115293 Insertion of Sensitive Information Into Sent Data in Kibana Leading to Credential Disclosure

Insertion of Sensitive Information Into Sent Data CWE-201 in Kibana Observability onboarding can lead to disclosure of the credentials that Kibana uses to connect to Elasticsearch. When these credentials are embedded in the Elasticsearch host URLs in the Kibana configuration, an authenticated use...

CVE-2026-115292 Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure

Authorization Bypass Through User-Controlled Key CWE-639 in Kibana Machine Learning can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs CAPEC-1. An authenticated user with Machine Learning read access in one Kibana space can read the audit and error...

CVE-2026-115290 Uncontrolled Recursion in Elasticsearch Leading to Denial of Service

Uncontrolled Recursion CWE-674 in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads CAPEC-230. An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate...

CVE-2026-115289 Use of Multiple Resources with Duplicate Identifier in APM Server Leading to Information Disclosure

Use of Multiple Resources with Duplicate Identifier CWE-694 in APM Server can lead to information disclosure via a specially crafted agent configuration request. An authenticated APM agent could receive the central agent configuration that belongs to a different service until the cached...

CVE-2026-119495 WordPress Better Search plugin <= 4.5.2 - Broken Access Control vulnerability

Missing Authorization vulnerability in WebberZone Better Search better-search allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Search: from n/a through 4.5.2...

CVE-2026-109594

Post-authentication Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability has been identified in the End-of-Life SonicWall GMS 9.5.2 and earlier versions which in specific conditions could potentially allow an authenticated attacker to access or modify...

CVE-2026-121602 Solanum before commit 2ce64de Heap Buffer Overflow via JOIN and SJOIN

Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server to corrupt memory by sending overlong channel names in JOIN or SJOIN messages. Attackers controlling a peer server can trigger strcpy and sprintf overflows in msjoin and mssjoin...

CVE-2026-121603 Solanum before commit 2ea1382 Buffer Overflow via Server-to-Server KILL Handler

Solanum before commit 2ea1382 contains a buffer overflow vulnerability in mskill that allows malicious linked servers to corrupt memory by sending an overlong kill reason. Attackers controlling a rogue or compromised peer server can send a reason exceeding KILLLEN that overflows a static 512-byte...

CVE-2026-109593

An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information...

CVE-2026-28336 SolarWinds Dameware Command Injection Vulnerability

SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host. Authentication is required...

CVE-2026-28335 SolarWinds Dameware Buffer Overflow Vulnerability

SolarWinds Dameware was found to be affected by a buffer overflow vulnerability that can result in remote code execution. Authentication is required...

CVE-2026-119674 mongorestore may restore encoded collection names into an unintended collection

MongoDB Database Tools mongorestore incorrectly URL-decodes an original collection name read from metadata when the corresponding dump filename has been truncated. A database user who can create and populate a suitably encoded collection can cause a later authorized directory restore to write tho...

CVE-2026-28327 SolarWinds Dameware DLL Hijacking Vulnerability

SolarWinds Dameware was found to be affected by a DLL hijacking vulnerability. The hijack occurs during installations only and requires access to the local machine and admin privileges...

CVE-2026-103916 Docker Sandboxes sbx cp follows workspace symlinks outside the authorized host directory

Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or replace a workspace symlink so that a later user-initiated copy reads a host file outside the workspace into the sandbox or writes sandbox-controlled data to a host path outsid...

CVE-2026-119673 mongofiles may write outside the working directory through a symlink

MongoDB Database Tools mongofiles does not resolve existing parent-directory symlinks when validating output paths for getregex. An unauthorized user who can both upload a GridFS file and place a symlink in the operator's download working directory can cause a later retrieval to create a file...

CVE-2026-119672 mongofiles may disclose GridFS content to standard output through a stored filename

MongoDB Database Tools mongofiles uses a database-stored GridFS filename as the output destination for getid when --local is not specified. A user who can modify the file metadata can set the stored filename to '-', causing a later authorized retrieval to write the file contents to standard outpu...

CVE-2026-119675 mongorestore may bypass collection guards through a system.buckets prefix

MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace filters, causing a restore to create an unauthorized...

CVE-2026-118505 AshAuthentication brute_force_strategy does not limit sign-in and request actions defined on the resource

Improper Restriction of Excessive Authentication Attempts vulnerability in team-alembic ashauthentication allows an unauthenticated attacker to guess passwords and one-time passwords without limit. The password, magic link and OTP strategies enforce bruteforcestrategy by adding a preparation only...

CVE-2026-119215 AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account

Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ashauthentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor...

CVE-2026-114582 Server-side request forgery via SpatialReference string input

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.SpatialReference and related transform methods and srs/srid setters do not restrict GDAL’s file and network access when parsing string input, which allows attackers to trigger...

CVE-2026-113733 Password hash disclosure to "view only" admin users with custom user models

An issue was discovered in Django 6.1 before 6.1.3 and 6.0 before 6.0.10. The django.contrib.admin.utils.displayforfield function did not obfuscate the password field of user models other than AUTHUSERMODEL, or of an AUTHUSERMODEL inheriting its password field from a concrete parent model through...

CVE-2026-113593 Potential exposure of private data via empty and missing Vary headers

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. The django.middleware.cache.UpdateCacheMiddleware and the django.views.decorators.cache.cachepage decorator generate identical cache keys for requests that omit a header listed in the response’s Vary...

CVE-2026-111362 Server-side request forgery via crs member of GeoJSON geometries

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.gdal.OGRGeometry does not restrict external coordinate reference system definitions in GeoJSON input, which allows remote attackers to cause server-side requests to attacker-selected...

CVE-2026-111211 Potential log injection via unescaped geometry form values

An issue was discovered in Django 6.1 before 6.1.3, 6.0 before 6.0.10, and 5.2 before 5.2.19. django.contrib.gis.forms.widgets.BaseGeometryWidget.deserialize, used by django.contrib.gis.forms.GeometryField, does not escape invalid submitted values before logging them, which allows remote attacker...

CVE-2026-108147 Potential memory exhaustion in MultiPartParser via base64-encoded file upload

An issue was discovered in Django 6.1 before 6.1.3, 6.0.4 before 6.0.10, and 5.2.13 before 5.2.19. django.http.multipartparser.MultiPartParser is subject to excessive memory consumption when processing multipart file uploads with base64 Content-Transfer-Encoding, which could be buffered entirely ...

CVE-2026-120758 NULL Pointer Dereference in H5HL_unprotect via Corrupted File

HDF5 through 2.2.0 contains a NULL pointer dereference vulnerability in H5HLunprotect in src/H5HL.c. H5HLprotect pins a single metadata cache entry for a local heap, either the heap prefix or the separate data block, and H5HLunprotect unpins it on the final unprotect. When the metadata cache...

CVE-2026-65168

NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code...

CVE-2026-65165

NVIDIA Slurm contains a vulnerability where a user could deliberately alter the provided nodelist alongside the --distribution=arbitrary option to gain access to compute nodes outside of the current job allocation...

CVE-2026-65140

NVIDIA Slurm contains some inconsistent authorization checks against the Operator permission level in the SlurmDBD that can be chained together in a way that would permit an Operator to make themselves an Administrator...

CVE-2026-65139

NVIDIA Slurm contains an attacker-controlled SQL injection attack in certain SlurmDBD RPCs that can lead to arbitrary code execution...

CVE-2026-120757 Heap Buffer Over-read via Non-Terminated Link Data in H5L__extern_traverse

HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5Lexterntraverse in src/H5Lexternal.c, the default traversal callback for external links. The callback locates the target file name and object path within the link’s user data using strlen without validating the buffer against...

CVE-2026-65138

NVIDIA Slurm contains an attacker-controlled arbitrary-memory read in the slurmstepd socket API that could be used to ex-filtrate authentication keys...

CVE-2026-65109

NVIDIA Slurm is subject to a symlink resolution issue in the container cleanup code that could allow an attacker to remove files outside of their control on the compute node...

CVE-2026-121578 CVE-2026-121578

Tactical RMM contains a stored XSS vulnerability caused by improperly validated input or encode output for various fields, enabling HTML/JavaScript to be stored in the tools database, which is then executed in the browsers of users when they view content containing the infected objects, leading t...

CVE-2026-120756 Heap Buffer Over-read via Malformed Message Size in HDF5's H5O__chunk_deserialize

HDF5 through 2.2.0 contains a heap buffer over-read vulnerability in H5Ochunkdeserialize in src/H5Ocache.c. When decoding object header messages, the declared message size is checked against the end of the chunk image before the remainder of the message header flags, and for version 2 object...

CVE-2026-121260 Ziroom ZHOME A0101 Lua zrUsb.lua loadstring code injection

A flaw has been found in Ziroom ZHOME A0101 1.0.1.0 Build 202004151405. This issue affects the function loadstring of the file usr/lib/lua/luci/controller/api/zrUsb.lua of the component Lua Handler. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploi...

CVE-2026-120755 Integer Underflow Leads to Out-of-Bounds Read via Truncated Chunk in HDF5 Szip Filter

HDF5 through 2.2.0 contains an out-of-bounds read vulnerability in H5Zfilterszip in src/H5Zszip.c. When decoding a szip-compressed chunk, the function subtracts the 4-byte uncompressed-length header from the chunk length without first verifying that the chunk is at least 4 bytes long. A truncated...

CVE-2026-118487 Heap exhaustion via unbounded line accumulation in Vert.x STOMP FrameParser

In Eclipse Vert.x versions 4.0.0, 4.5.35 or 5.0.0, 5.2.2, the FrameParser in vertx-stomp creates a RecordParser without setting maxRecordSize, so any peer that streams bytes continuously without a newline character causes the parser to accumulate data indefinitely. Both the STOMP server and the...

CVE-2026-119741 rsync through 3.5.1 Denial of Service via hash_search() Checksum Collisions

rsync through 3.5.1 contains a denial of service vulnerability in the delta-transfer sender's hashsearch in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attackers pulling from a public daemon module can supply weak...

CVE-2026-121564 Silent loss of messages when merging overlapping chat exports in whatstk

Incomplete Comparison with Missing Factors CWE-1023 in mergechats whatstk/utils/chatmerge.py, reached from BaseChat.merge, in whatstk from 0.3.0 before 0.9.0 allows a party that supplies the chat exports to cause messages to be absent from the merged output with no indication that anything was...

CVE-2026-120754 Uninitialized Heap Memory Disclosure via Truncated Chunk in HDF5 Scale-Offset Filter

HDF5 through 2.2.0 contains an uninitialized memory read vulnerability in H5Zfilterscaleoffset in src/H5Zscaleoffset.c. The decode path validates reads against the allocated size of the chunk buffer rather than the number of bytes actually read from the file. Because H5Dchunklock deliberately siz...

CVE-2026-97350 Local Privilege Escalation via OpenVPN Configuration and Proxy Settings in Securepoint SSL VPN Client v2 for Windows

Securepoint SSL VPN Client v2 on Windows contains vulnerabilities in the handling of OpenVPN configurations and proxy settings that allow non-privileged local users to influence operations performed with NT AUTHORITY\SYSTEM privileges. Two attack vectors have been identified: Improper authorizati...

CVE-2026-65108

NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd process while the slurmstepd is running with root permissions...

CVE-2026-65107

NVIDIA Slurm contains a vulnerability where a user could alter the supplemental group list as part of an sbcast file transmission to write a file to a path they would not normally have access to...

CVE-2026-73328 Volmarg Personal Management System through 2.1.0 Unrestricted File Upload RCE via /upload/send/

Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as...

CVE-2026-121560 LogChimp before 0.9.3 Authorization Bypass via PATCH /api/v1/posts

LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post authors to modify any other post by supplying mismatched postId and id body parameters. Attackers can set postId to their own post and id to an enumerated victim post UUID to overwrit...

CVE-2026-121559 GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 Privilege Escalation via User Cloning

GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 contains a privilege escalation vulnerability that allows authenticated users to obtain elevated profiles by cloning accounts. A user with the Technician profile can clone a Super-Admin account with a new login and password, since...

CVE-2026-121556 FastBee through 2.1.0 IDOR via /iot/product By-ID Endpoints

FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows authenticated tenant users to access other tenants' products by supplying their product IDs. Attackers can enumerate sequential product IDs to read MQTT account, password, and secret...