CVE-2026-19589 Packer vulnerable to arbitrary file write via crafted plugin archive during installation

Packer up to 1.15.4 is vulnerable to an issue in the third-party plugin installer that may allow unintended file system modification and could lead to code execution. A user who installs a plugin from a malicious or compromised source may be affected. This vulnerability CVE-2026-19589 is fixed in...

CVE-2026-71858 Notepad++: shortcuts.xml Macro HMAC Bypass Enables Conditional Elevated Command Execution

Notepad++ is a free and open-source source code editor. Prior to 8.9.7, macros loaded from an attacker-controlled shortcuts.xml bypass the HMAC validation applied to UserDefinedCommands and can invoke Scintilla actions and the internal Open in Default Viewer command in an elevated Notepad++...

CVE-2026-19650 Cross-Site Request Forgery (CSRF) in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could have allowed an unauthenticated user to execute mutations via GET requests due to improper request...

CVE-2026-19478 Improper Control of Generation of Code ('Code Injection') in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.11.11, 19.0 before 19.0.8, 19.1 before 19.1.6, and 19.2 before 19.2.4 that under certain conditions could allow an unauthenticated user to remotely modify or delete public projects and user data via a GraphQ...

CVE-2026-71553 ApostropheCMS: 2nd-order prototype pollution via PATCH leading to single-request persistent DoS

ApostropheCMS is an open-source Node.js content management system. In 4.32.0 and earlier, PATCH /api/v1/article/:id accepts the inherited path toString.call and passes it through the utility module to apos.util.set and apos.util.get, allowing an authenticated editor to overwrite the shared...

CVE-2026-63667 ApostropheCMS: Arbitrary file read via import-export attachment-name path traversal

ApostropheCMS is an open-source Node.js content management system. Prior to 3.6.2, the import-export module in packages/import-export/lib/formats/gzip.js constructs an attachment source path from the attacker-controlled id, name, and extension fields in aposAttachments.json without ensuring that...

CVE-2026-75014 SourceCodester Pet Grooming Management Software get_barcode_data.php sql injection

A flaw has been found in SourceCodester Pet Grooming Management Software 1.0. This vulnerability affects unknown code of the file /admin/getbarcodedata.php. This manipulation of the argument barcode causes sql injection. The attack may be initiated remotely. The exploit has been published and may...

CVE-2026-74234 Legora < 2026-08-14 XSS via Mermaid gray-matter JavaScript Engine

Legora before 2026-08-14 contains a cross-site scripting vulnerability that allows attackers to achieve arbitrary JavaScript execution in a victim's browser by embedding a Mermaid block prefixed with a gray-matter JavaScript front-matter directive, causing the front-matter parser to invoke eval...

CVE-2026-17639 Certain HP Smart Tank All in One – Potential Denial of Service

Certain HP Smart Tank All-in-One printers may be potentially vulnerable to a denial of service condition that allows an unauthenticated attacker to cause the device to become unavailable by sending multiple concurrent HTTP requests...

CVE-2026-45698 Netatalk has Integer Underflow → Stack Buffer Overflow in deletedir()

Netatalk is a Free and Open Source file server suite for Unix-like operating systems. In versions 3.1.19 through 4.4.2, a stack-based buffer overflow exists in the deletedir function of Netatalk's afpd daemon due to an integer underflow in the calculation of the remaining buffer size used for pat...

CVE-2026-12553 HP Web Jetadmin (WJA) - Potential Arbitrary File Read/Write

HP has identified a potential vulnerability in HP Web Jetadmin WJA that may allow an unauthenticated actor to read from or write to arbitrary files through a DLL hijacking mechanism...

CVE-2026-48053 Kolibri has Unauthenticated Server-Side Request Forgery (SSRF) in RemoteFacilityUserViewset

Kolibri is an offline-first education platform. Prior to version 0.19.4, several Kolibri API endpoints accept an unvalidated baseurl parameter and fetch attacker-controlled URLs from the Kolibri server, reflecting the response body back to the caller. The original report identified two endpoints ...

CVE-2026-54284 sqlparse: TokenList.__init__ materializes O(subtree) value per group, causing CPU DoS before depth/token caps trigger

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, TokenList construction and string conversion in sqlparse/sql.py repeatedly flatten nested token subtrees constructed by groupparenthesis and groupcase, causing quadratic CPU consumption through sqlparse.parse,...

CVE-2026-59893 sqlparse: Inefficient Regex Handling of Dollar-Quoted SQL Literals Leads to ReDoS (Denial of Service)

sqlparse is a non-validating SQL parser module for Python. Prior to 0.6.0, SQLREGEX in sqlparse/keywords.py and the per-position loop in sqlparse/lexer.py repeatedly scan unmatched dollar-quoted literal and multiline-comment delimiters, causing quadratic CPU consumption through sqlparse.parse,...

CVE-2026-71979 INDI indiserver 2.2.4.2 Stack Buffer Overflow via XML Tag Parsing

INDI Instrument Neutral Distributed Interface indiserver through 2.2.4.2, fixed in commit 96bbd7f, contains a stack buffer overflow vulnerability that allows unauthenticated remote attackers to crash the daemon by sending malformed XML with mismatched tags whose names exceed 1024 bytes. Attackers...

CVE-2026-74253 Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer < 14.0.0

Joomla Extension - regularlabs.com - Unauthenticated RCE through unverified reflected user input in Sourcerer 14.0.0 - Regular Labs Sourcerer before 14.0.0 processes source blocks found in Joomla’s final rendered HTML without reliably determining where that code originated...

CVE-2026-68519 Glances: `--disable-config-exec` does not cover on-alert action commands (incomplete fix of CVE-2026-53925)

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, GlancesActions.run in glances/actions.py ignores --disable-config-exec for on-alert action commands and invokes securepopen with shell operators enabled, allowing configured redirection, command chaining, or pipes to...

CVE-2026-74254 Joomla Extension - joomlack.fr - SQL injection in Page Builder CK < 3.6.5

Joomla Extension - joomlack.fr - SQL injection in Page Builder CK 3.6.5 - The Joomla extension Page Builder CK is vulnerable to a SQL injection issue related to the styles model. Version 3.6.4 fixed the vector in the frontend, 3.6.5 in the backend...

CVE-2026-62982 Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, sanitizemustachedict in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render and be executed by securepopen through...

CVE-2026-68520 Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, asdictsecure in glances/config.py checks only option names and exposes publicusername and credentials embedded in publicapi values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This iss...

CVE-2026-68518 Glances: Command injection bypass of action-template sanitizer via cross-field shell-operator reconstruction

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, sanitizemustachedict in glances/actions.py sanitizes individual Mustache values before chevron.render, allowing adjacent unescaped Mustache variables to reconstruct shell operators that securepopen executes when...

CVE-2026-61666 websocket-driver: Denial of service via malformed Host header

websocket-driver is a WebSocket protocol handler with pluggable I/O. Prior to 0.8.2, WebSocket::Driver.server passes a malformed Host header to URI.parse in lib/websocket/http/request.rb without catching URI::InvalidURIError, allowing a remote client to crash a TCP-backed WebSocket server when th...

CVE-2026-71479 New API: Integer overflow in quota billing yields negative charges (self-crediting)

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, maxtokens, maxcompletiontokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversio...

CVE-2026-75059

In JetBrains PyCharm before 2026.2.1 code execution via Quick Documentation was possible...

CVE-2026-75060

In JetBrains PyCharm before 2026.2.1 code execution was possible via unauthenticated Jupyter MCP tools...

CVE-2026-75056

In JetBrains IntelliJ IDEA before 2026.2.1 rCE via Markdown export tool was possible...

CVE-2026-75054

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the OpenAPI preview proxy in untrusted projects...

CVE-2026-75055

In JetBrains IntelliJ IDEA before 2026.2.1 hadoop ResourceManager could read local files via XXE...

CVE-2026-75051

In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible...

CVE-2026-75052

In JetBrains IntelliJ IDEA before 2026.2.1 command execution via crafted Markdown preview content was possible in trusted projects...

CVE-2026-75053

In JetBrains IntelliJ IDEA before 2026.2.1 sSRF was possible via the DevKit debug listener endpoint...

CVE-2026-75050

In JetBrains YouTrack before 2026.1.13901, 2026.2.17950 doS attack was possible via crafted type parameters...

CVE-2026-75048

In JetBrains YouTrack before 2026.2.18068 stored XSS via the fenced code-block language label was possible...

CVE-2026-75049

In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint...

CVE-2026-75047

In JetBrains YouTrack before 2026.2.18177 doS attack was possible via a decompression bomb in the import endpoint...

CVE-2026-75046

In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint...

CVE-2026-75044

In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via the mailbox endpoint...

CVE-2026-75045

In JetBrains YouTrack before 2025.3.156085, 2026.1.13913, 2026.2.18112 an unauthenticated attacker could download database backups via shared draft signature...

CVE-2026-68762

In JetBrains Ktor before 3.4.1 potential DoS attack via WebSocket decompression was possible...

CVE-2026-64868 New API: Unauthenticated payment webhooks allow memory and disk DoS via unbounded body reads and full-body logging

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.11, POST /api/stripe/webhook, POST /api/creem/webhook, and POST /api/waffo/webhook read and log full request bodies before signature validation in router/api-router.go and the...

CVE-2026-64859 New API: User List API Leaks Root User Access Token Leading to Privilege Escalation

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.7, the admin user list and user lookup APIs, including GET /api/user/, return User.AccessToken as accesstoken because User model objects are serialized after queries use...

CVE-2026-73646 PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure

PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract Syntax Tree. Prior to 8.5.18, lib/previous-map.js loadMap passes attacker-controlled sourceMappingURL values to joindirnameopts.from, annotation, and loadFile permits traversed ...

CVE-2026-59829 Discourse: Review queue exposes flag-related private message excerpts to category group moderators

Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1, on sites with category group moderation enabled, the review queue could include an excerpt and permalink of the private message attached to a flag, even when the reviewing category moderator was...

CVE-2026-73851 Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package e.g. ../../../../etc/passwd, an absolute path, or a file:// /...

CVE-2026-71567 User-controlled variables inserted unescaped into shell scripts and Kubernetes manifests

In openshift-metal3/fakefish there is a repeated pattern in some of the scripts where shell variables are injected without quoting them either into command lines or into manifests. This mostly applies to the Image URL and BMC credentials which are not verified by FakeFish...

CVE-2026-10527 Boards plugin retains Board Admin rights for users demoted to System Guest

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21, 11.8.x = 11.8.3 fails to reconcile SchemeAdmin flags with a user's current role which allows a user demoted to System Guest to retain Board Admin privileges and perform admin-only operations via the Boards REST API or UI.. Mattermost Adviso...

CVE-2026-15754 Missing per-channel team-scope check in ABAC access control policy unassign allows cross-team policy removal

Mattermost versions 11.7.x = 11.7.6, 11.8.x = 11.8.3 The access control policy unassign endpoint fails to re-validate that each target channel still belongs to the requesting admin's team, which allows an authenticated team administrator to remove ABAC attribute-based access control policy...

CVE-2026-16044 Insufficient validation of guest board admin privileges on archive import

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 fail to prevent guest users from receiving Board Admin privileges during board archive import which allows a board member to escalate a guest user to Board Admin via importing a crafted .boardarchive file. Mattermost Advisory ID:...

CVE-2026-16045 Delegated OAuth tokens could revoke unrelated OAuth application authorizations

Mattermost versions 11.7.x = 11.7.6, 10.11.x = 10.11.21 Mattermost failed to restrict OAuth deauthorization and personal access token management endpoints to direct user sessions, which allowed an OAuth app with a delegated user token to revoke the user's authorizations or tokens for other...

CVE-2026-16049 _GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue API endpoints_

Mattermost Plugins versions =11.8 10.20.11 11.5.7.0 The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a caller-supplied postid, and fails to validate the weburl parameter against the configured GitLab instance, which allows an authenticated attacke...