CVE-2026-62999 Copier: Percent-encoded dot segments in template URLs can allow trusted-prefix escape (Incomplete fix for trust-prefix bypass)

Copier is a library and CLI app for rendering project templates. From 9.5.0 through 9.16.0, percent-encoded parent-directory segments or encoded path separators in a template URL can match a configured trusted repository prefix before an HTTP server or Git transport decodes the path, allowing...

CVE-2026-53510 Savon::Model evaluates WSDL operation names as Ruby source

Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .alloperations interpolates attacker-controlled WSDL operation names into Ruby source passed to moduleeval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2...

CVE-2026-18394 Incorrect authorization in Strands Agents Tools http_request proxy credential exfiltration

Incorrect authorization in the httprequest tool in Strands Agents Tools before 0.8.2 might allow remote attackers to obtain credentials configured via HTTPREQUESTTOKENCONFIG by influencing the LLM to route requests through actor-controlled proxy infrastructure. To remediate this issue, users shou...

CVE-2026-65841 Jodit has cross-site scripting (XSS) via <script> nested in SVG that bypasses clean-html sanitization

Jodit Editor is a WYSIWYG editor with a built-in file browser & image editor. Prior to 4.13.6, Jodit's clean-html denyTags filter does not normalize foreign SVG or MathML script node names, allowing a script element nested directly in SVG or MathML to remain in editor.value and execute when conte...

CVE-2026-55824 Contao crawler leaks auth credentials to external hosts

Contao is an Open Source CMS. In versions 4.13.40 through 5.3.46 and 5.7.0-RC1 through 5.7.6, the crawler leaks auth credentials to external hosts. Contao's crawler tries to prevent confidential HTTP client options from being sent to external domains by creating a scoped client: full options for...

CVE-2026-53502 Thumbor has path traversal via post-validation URL decoding bypass in file_loader

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, fileloader decodes percent-encoded path segments after its root-boundary validation, allowing traversal outside FILELOADERROOTPATH through watermark or frame filter input. This issue is fixed in 7.8.0...

CVE-2026-53501 Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature

Thumbor is an open-source photo thumbnail service by globo.com. Prior to 7.8.0, Thumbor’s HMAC validation can be bypassed due to the use of Python’s .replace when removing the signature from the URL before validation. Since .replace removes all occurrences of the substring, an attacker can insert...

CVE-2026-25552 Ghost CLI < 1.30.1 IP Spoofing via X-Forwarded-For Header

Ghost CLI before 1.30.1 contains an IP spoofing vulnerability that allows unauthenticated remote attackers to bypass rate-limiting controls by manipulating the X-Forwarded-For header through a misconfigured Nginx configuration. Attackers can append attacker-controlled values to the header chain...

CVE-2026-18481 Stored XSS in Participant URL Field leads to Account Takeover via Session Token Theft

Stored cross-site scripting in the participant URL handling in AWS Ops Wheel before PR 168 might allow an authenticated remote user to steal session tokens and escalate to full administrative control of the deployed instance via a crafted participanturl value containing a dangerous URI scheme. To...

CVE-2026-18321 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') in ntpsec

Buffer overflow in NTPsec's Zyfer refclock allows local attacker to crash ntpd...

CVE-2026-54737 @phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This iss...

CVE-2026-54725 vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API

vault-secrets-webhook is a Kubernetes mutating webhook that makes direct secret injection into Pods possible. Prior to 1.23.1, parseVaultConfig in pkg/webhook/config.go accepts the vault.security.banzaicloud.io/vault-addr annotation, MutateConfigMap and MutateSecret call newVaultClient in...

CVE-2026-34497 FMS Employee Vulnerable to HTML Injection

Improper neutralization of Script-Related HTML tags in a web page basic XSS vulnerability in Johnson Controls FM Systems Employee allows Cross-Site Scripting XSS. This issue affects FM Systems Employee: before 2025.3.1...

CVE-2026-34495 FMS Employee vulnerable to XSS

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Johnson Controls FM Systems Employee allows Stored XSS. This issue affects FM Systems Employee: before 2025.3.1...

CVE-2026-21662 FMS Employee Allows Upload of Unrestricted Files

Unrestricted upload of file with dangerous type vulnerability in Johnson Controls FM Systems Employee allows Using Malicious Files. This issue affects FM Systems Employee: before 2025.3.1...

CVE-2026-34490 XAAP Android Data Stored in Unencrypted Database

Cleartext storage of sensitive information vulnerability in Johnson Controls XAAP Application on Android allows an attacker on a jailbroken or otherwise compromised device to Retrieve Sensitive Data. This issue affects XAAP Application: before 1.53...

CVE-2026-55100 hashi-vault-js has a path traversal and query parameter injection

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, src/Vault.js concatenates unencoded identifier values including name, username, group, role, and version into Vault request paths and query strings instead of using encodeURIComponent and...

CVE-2026-54729 dssrf: any users using 1.1.1.1 DNS is impacted by SSRF

DSSRF is a Node.js library that provides a wide range of utilities and advanced SSRF defense checks. Prior to 1.0.5, isurlsafe can treat localhost as safe when DNS resolver 1.1.1.1 returns NXDOMAIN because dns.resolve4 yields no address and no dns.lookup fallback occurs, allowing server-side...

CVE-2026-58048

Improper preservation of SQL mode when renaming databases in cPanel allows execution of SQL in root context...

CVE-2026-58047

HTTP Smuggling in cPanel allows potential leak of credentials...

CVE-2026-54706 OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files

OnionShare is an open source tool that lets you securely and anonymously share files, host websites, and chat with friends using the Tor network. Prior to 2.6.4, OnionShare CLI/Desktop follows symbolic links in cli/onionsharecli/web/sendbasemode.py through SendBaseModeWeb.setfileinfo and...

CVE-2026-52856 Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, a malformed packet received during the SFTP connection handshake causes a Go panic. This issue is fixed in version 1.13.0...

CVE-2026-52855 Wings exposes node configuration secrets through egg configuration-file templating

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.12.3, config. placeholders in egg configuration-file templates allow a low-privileged user to read config.token, config.tokenid, and config.docker.registries from the full daemon...

CVE-2026-52857 Wings: Maliciously or erroneously created parsed config files can cause wings process to OOM

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers in parser.go can process an oversized non-file parser configuration file and exhaust Wings process memory. This issue is...

CVE-2026-59232 Stored Cross-site Scripting in Prospero Flow CRM lead name field

Cross-site Scripting in the lead index view in Roskus Prospero Flow CRM before 5.3.7 allows authenticated users holding the create or update lead permission to execute arbitrary JavaScript in the application origin via HTML markup stored in the lead name field, which the view renders through...

CVE-2026-17566 pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)

pgAdmin 4's Import/Export Data tool builds a psql \copy ... command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the ... wrapper, createimportexportjob route POST...

CVE-2026-17351 pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045)

The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's executesqlquery tool to parse, via sqlparse, as exactly one non-transaction-control statement before running it inside a BEGIN TRANSACTION READ ONLY wrapper. sqlparse's string-literal lexing...

CVE-2026-17350 pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers

The per-tool permission system custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3 did not enforce its permission check consistently. In SERVER mode, pgAdmin 4 gates each tool behind a per-tool Flask-Security permission, but the permission decorator permissionsrequired was...

CVE-2026-17349 pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner

/misc/workspace/adhocconnectserver, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone, which copies every column from the source row, including userid, shared, sharedusername, and the stored credential fields...

CVE-2026-17348 pgAdmin 4: Missing authentication decorator on Constraints, preferences, Debugger and Schema Diff routes allows unauthenticated access in SERVER mode (incomplete fix for CVE-2026-12046)

In SERVER mode, pgAdmin 4 enforces authentication per route via the @pgaloginrequired decorator; the application's beforerequest hook only handles desktop-mode auto-login and the Kerberos/Webserver-auth redirect, so any route shipped without the decorator is reachable without authentication...

CVE-2026-17347 pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution

The MASTERPASSWORDHOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username directly into the...

CVE-2026-17346 pgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044)

The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgstatindex templates to it, but missed several sinks that had been placed in testsqlstringliterallint.py's ALLOWLIST on the incorrect assumption that schema, table, publication, and...

CVE-2026-67607 LightFTP 2.3.1 Race Condition DoS via worker_thread_cleanup

LightFTP 2.3.1 contains a race condition vulnerability that allows remote attackers to crash the server by racing a fresh connection that reuses the FTP context against an in-progress ABRT cleanup. Attackers can exploit the unprotected re-check of WorkerThreadId between workerthreadcleanup and...

CVE-2026-10686 Missing hop-limit decrement on IPv6 forwarding path allows unbounded packet looping (DoS) in Zephyr routers

Zephyr's IPv6 forwarding path re-sent routed unicast packets without ever decrementing the IPv6 hop limit. Both routing branches of ipv6routepacket subsys/net/ip were affected: the explicit-route path netroutepacket and the on-link cross-interface path netroutepacketif. Each set the packet...

CVE-2026-18141 Aap-gateway: aap-gateway: authentication bypass in event-driven ansible via forged http header

A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible EDA. An unauthenticated remote attacker can bypass mutual Transport Layer Security mTLS authentication for event streams. This is achieved by manipulating the event stream URL and forging the HTTP...

CVE-2025-62347

HCL iControl was affected by Improper Input Validation vulnerability. It is vulnerable to unexpected system behavior and potential security bypasses. This was caused by an implementation flaw in an architectural security tactic that fails to properly validate whether the received input matches th...

CVE-2026-56571 HCL iControl is affected by multiple security vulnerabilities.

HCL iControl was affected by Improper Error Handling vulnerabilities. It involves Out of memory, null pointer exceptions, system call failure, database unavailable, network timeout, and hundreds of other common conditions can cause errors to be generated...

CVE-2026-59231 Server-Side Request Forgery in Pentestify PDF export via unvalidated image URLs

Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to cause outbound HTTP GET requests from the server to arbitrary attacker-chosen destinations via unvalidated URLs stored in the finding images field or the report clientlogo fiel...

CVE-2026-56570 HCL iControl is affected by multiple security vulnerabilities.

HCL iControl was affected by Auto complete Enabled vulnerabilities. It involves expose sensitive information such as: Valid usernames, Email addresses used for login, Account identifiers If the system is accessed from shared environments, attackers may enumerate valid usernames through browser...

CVE-2026-56569 HCL iControl is affected by multiple security vulnerabilities.

HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening...

CVE-2026-56568 HCL iControl is affected by multiple security vulnerabilities.

HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/API error messages to users instead of generic error messages and exposes internal endpoint names, request parameters, error codes, and...

CVE-2026-56567 HCL iControl is affected by multiple security vulnerabilities.

HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application hardening...

CVE-2026-10685 Use-after-free of GATT subscribe params in Bluetooth host CCC-write response handler

The Zephyr Bluetooth GATT client CCC-write response handler gattwritecccrsp in subsys/bluetooth/host/gatt.c invoked the application's params-subscribe callback after it had already called params-notifyconn, params, NULL, 0. Per the public GATT API, a notify callback with NULL data is the document...

CVE-2026-18446 fast-uri vulnerable to host confusion via backslash authority introducer

fast-uri before 4.1.2, 3.1.5, and 2.4.4 requires a literal double forward slash to recognize a URI authority, so a reference that uses a backslash based introducer in place of it backslash backslash, forward slash backslash, or backslash forward slash is parsed with no authority and folds into th...

CVE-2026-28144 WordPress WP Maps plugin <= 4.9.6 - Sensitive Data Exposure vulnerability

Insertion of Sensitive Information Into Sent Data vulnerability in Flipper Code WP Maps allows Retrieve Embedded Sensitive Data. This issue affects WP Maps: from n/a through 4.9.6...

CVE-2026-65636 YAML injection via unescaped newlines in ymlr document comments

Improper Neutralization of CRLF Sequences vulnerability in ufirstgroup ymlr Elixir.Ymlr module allows attackers to inject arbitrary content into generated YAML documents through document comments. Ymlr.document!/2 interpolates each caller-supplied comment string into the output behind a single...

CVE-2026-28145 WordPress MasterStudy LMS plugin <= 3.7.39 - Broken Access Control vulnerability

Insufficient Verification of Data Authenticity vulnerability in StylemixThemes MasterStudy LMS allows Manipulating User State. This issue affects MasterStudy LMS: from n/a through 3.7.39...

CVE-2026-17561 Unauthenticated RCE in Innotim Software's Logsign SIEM

Improper Control of Generation of Code 'Code Injection' vulnerability in Innotim Software, Telecommunications and Consulting Trade Ltd. Co. Logsign SIEM allows Code Injection. This issue affects Logsign SIEM: before 6.4.108...

CVE-2026-18358 Gnome-remote-desktop: gnome-remote-desktop system-mode rdp server missing connection throttling allows unauthenticated denial of service

A flaw was found in gnome-remote-desktop as shipped in Red Hat Enterprise Linux. When the daemon is running in system mode with RDP enabled, the incoming connection handler bypasses the connection throttler, allowing an unauthenticated remote attacker to open many parallel pre-authentication...

CVE-2026-44615 Path traversal in NotebookRepo note and folder path composition

Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authenticated attacker with permission to rename a note, or access to folder operations, could supply traversal segments in note or folder paths. Zeppelin composed these values into...