CVE-2026-112402 Pillow: Double free in ImagingScaleAffine on calloc failure via Image.transform

Pillow is a Python imaging library. Prior to 13.0.0, Pillow can double free image memory when ImagingScaleAffine encounters a selective allocation failure. The affected fast path handles Transform.EXTENT or pure scale-and-translate Transform.AFFINE operations with the default NEAREST resampling...

CVE-2026-112397 Pillow: Out-of-bounds access in _imagingmorph on a zero-width image

Pillow is a Python imaging library. Prior to 13.0.0, Pillow's ImageMorph.MorphOp.apply can access memory before a row buffer for a zero-width image. PPM and PGM input can create an image with width zero, and the native morphology routine indexes outrowwidth - 1 without rejecting that geometry. An...

CVE-2026-53995 MLflow 3.17.1 Path Traversal via Trace ID API

MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit...

CVE-2026-112393 Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO

Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow has a heap buffer overflow and stale-heap disclosure in tiffWriteProc when saving compressed TIFF data through libtiff to a target without a usable fileno, such as BytesIO. The callback sizes its allocation from the prior buffer...

CVE-2026-112301 orbitale imagemagick-php Command.php font os command injection

A security flaw has been discovered in orbitale imagemagick-php up to 3.3.5. Affected by this issue is the function Command::font of the file src/Command.php. The manipulation of the argument fontFile results in os command injection. The attack can be executed remotely. The exploit has been...

CVE-2026-112254 agit8or1 clientst0r Property URL Importer property_url_importer.py _fetch_html server-side request forgery

A vulnerability was found in agit8or1 clientst0r up to 3.17.586. Affected by this vulnerability is the function fetchhtml of the file locations/services/propertyurlimporter.py of the component Property URL Importer. The manipulation of the argument url results in server-side request forgery. The...

CVE-2026-112260 Gimp: gimp: heap out-of-bounds read in xcf text-layer parasite parsing

A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service...

CVE-2026-112778 Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernetes Annotations

Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespaces. Attackers able to create or update Ingress or Service...

CVE-2026-112773 Craft CMS 5.0.0 before 5.11.0 RCE via Twig Sandbox Behavior Injection

Craft CMS from 5.0.0 before 5.11.0 contains a remote code execution vulnerability that allows authenticated Control Panel users to escape the Twig sandbox by passing uncleansed criteria to getNext, getPrev, or getOwners. Attackers can inject Yii "as" or "on" config keys to attach malicious event...

CVE-2026-112768 Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update

Parse Server before 8.6.99 and 9.0.0 before 9.10.3-alpha.2 evaluates checks against the target account during a user update before authorizing the caller, and reflects their outcome in the response. An unauthorized caller, with or without a session, can confirm guessed usernames or emails and, wh...

CVE-2026-112251 antoinersx clawhost Reverse Proxy reverseProxy.ts handleRequest redirect

A vulnerability was detected in antoinersx clawhost up to 0.0.45. This affects the function handleRequest of the file apps/clawhostgo/src/main/services/reverseProxy.ts of the component Reverse Proxy. Performing a manipulation of the argument token results in open redirect. The attack can be...

CVE-2026-112248 grandnode grandnode2 Excel Import ProductImportDataObject.PrepareProductPictures path traversal

A security vulnerability has been detected in grandnode grandnode2 up to 2.3.0. This impacts the function ProductImportDataObject.PrepareProductPictures of the component Excel Import. The manipulation of the argument Picture1/Picture2/Picture3 leads to path traversal. The attack can be initiated...

CVE-2026-4418 IBM Cloud Pak System HTML Injection

IBM Cloud Pak System 2.3.6.0, and 2.3.6.1 is vulnerable to HTML injection. A remotely authenticated attacker could inject malicious HTML code, which when viewed, would be executed in the victim's Web browser within the security context of the hosting site...

CVE-2026-111759 markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes

markdown-it is a Markdown parser. Prior to 14.3.2 and 15.0.2, when typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input. Many opening double quotes...

CVE-2026-111755 follow-redirects sensitiveHeaders regex escaping can expose credential headers

follow-redirects is a Node.js HTTP and HTTPS client wrapper that automatically follows redirects. From 1.16.0 until 1.16.1, escapeRegex leaves valid header-name metacharacters unescaped in sensitiveHeaders. When an application declares a sensitive header whose name contains ^ or | and follows a...

CVE-2026-1501 IBM Concert Software Improper Certificate Validation

IBM Concert 1.0 through 3.0.0 is vulnerable to Improper Certificate Validation...

CVE-2026-1510 IBM Concert Software Improper Clearing of Heap Memory

IBM Concert 1.0 through 3.0.0 is vulnerable to Information Disclosure via Heap Inspection...

CVE-2026-4405 IBM Concert Software Use of Web Browser Cache Containing Sensitive Information

IBM Concert 1.0 through 3.0.0 allows web page cache to be stored locally which can be read by another user on the system...

CVE-2026-4413 IBM Concert Software Cross-Site Scripting

IBM Concert 1.0 through 3.0.0 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session...

CVE-2026-6930 IBM Concert Software Risky Cryptographic Algorithm

IBM Concert 1.0 through 3.0.0 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information...

CVE-2026-111748 AIOHTTP: Absolute-form request targets can spoof Request.scheme

AIOHTTP is an asynchronous HTTP client/server framework for asyncio and Python. Prior to 3.14.4, an attacker can send an absolute-form request that causes Request.scheme to use attacker-controlled request-target scheme data instead of the connection protocol. Applications that use Request.scheme...

CVE-2026-112195 FusionPBX Dialplan Editor dialplan.php os command injection

A flaw has been found in FusionPBX up to 5.4.4/5.5.7/5.6.5. The affected element is an unknown function of the file app/dialplans/resources/classes/dialplan.php of the component Dialplan Editor. Executing a manipulation can lead to os command injection. The attack can be executed remotely. The...

CVE-2026-10743 IBM MQ Race Condition

IBM MQ could allow an authenticated attacker to cause a denial of service or corrupt memory due to improper validation of buffer sizes in MQOPEN operations...

CVE-2026-11828 IBM MQ Buffer Overflow

IBM MQ could allow a remote attacker with queue manager control or man-in-the-middle access on unencrypted channels to cause a denial of service in client applications using asynchronous message consumption due to improper validation of queue name length values...

CVE-2026-11829 IBM MQ Buffer Overflow

IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of offset values in MQOPEN requests...

CVE-2026-12155 IBM MQ Deserialization of Untrusted Data

IBM MQ could allow an authenticated attacker to cause a denial of service by sending specially crafted multicast status messages that trigger a NULL pointer dereference...

CVE-2026-12343 IBM MQ Denial of Service

IBM MQ could allow an authenticated attacker to cause a denial of service due to improper validation of RFH2 message header fields in queued publish/subscribe operations...

CVE-2026-12350 IBM MQ Deserialization of Untrusted Data

IBM MQ could allow an authenticated attacker to cause a denial of service by sending a specially crafted asynchronous consume request that crashes the queue manager agent process...

CVE-2026-12669 IBM MQ Out-of-bounds Read

IBM MQ could allow an authenticated attacker to trigger a minor out-of-bounds read when sending malformed compressed data, though the data is not disclosed and the request is rejected...

CVE-2026-12727 IBM MQ Buffer Overflow

IBM MQ could allow an authenticated attacker to cause potential process instability due to an off-by-one buffer overflow when processing specially crafted object names...

CVE-2026-12670 IBM MQ Denial of Service

IBM MQ could allow an authenticated attacker to cause a denial of service through a specially crafted message that triggers excessive memory operations during character set conversion...

CVE-2026-111061 russh agent server converts constraint records into unbounded never-rolled-back tasks

russh is a Rust SSH client and server library that includes an SSH agent protocol implementation. Prior to 0.64.1, the agent server spawns a separate long-lived task for every SSHAGENTCONSTRAINLIFETIME record in a constrained add-key request. The loop accepts repeated lifetime records, clones the...

CVE-2026-112190 Webkul Aureus ERP composer.json insertion of sensitive information into debugging code

A security vulnerability has been detected in Webkul Aureus ERP up to 1.6.0. This issue affects some unknown processing of the file composer.json. Such manipulation leads to insertion of sensitive information into debugging code. The attack may be launched remotely. The exploit has been disclosed...

CVE-2026-111058 Mercury: Unauthenticated Remote Code Execution via /api/kernels

Mercury is a Python framework for sharing Jupyter notebooks as web applications and dashboards. Prior to 3.2.6, default tokenless deployments allow anonymous clients to create Jupyter kernels and send executerequest messages containing arbitrary Python. The endpoint blocklist does not cover...

CVE-2026-112158 MikroTik RouterOS ipt_SAME.ko same_check integer overflow

A weakness has been identified in MikroTik RouterOS up to 6.40.5/6.44/7.20.8. Impacted is the function samecheck of the file iptSAME.ko. Executing a manipulation can lead to integer overflow. The attack may be launched remotely. Upgrading to version 7.21.5 and 7.23.1 is recommended to address thi...

CVE-2026-111053 FOSSBilling: Unauthenticated attacker can probe existence of arbitrary files via guest/system/template_exists

FOSSBilling is an open source billing and client-management platform. From 0.1.0 until 0.8.7, the unauthenticated api/guest/system/templateexists endpoint permits path traversal because templateExists uses Path::join on the attacker-controlled file parameter without rejecting .. sequences or...

CVE-2026-111046 FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions

FOSSBilling is an open source billing and client-management platform. From 0.8.4 until 0.8.6, hasManagePermission fails open for inactive non-core modules because its early return on !isExtensionActive skips the module-access and managesettings checks. A low-privileged staff account with...

CVE-2026-111045 CLI Bridge: High-severity sandbox escape via dangling symlink

CLI Bridge provides filesystem access within a workspace root. Prior to 0.0.2, a dangling symlink pointing outside the workspace root bypasses resolveSafePath when fs.realpathSync throws ENOENT for a nonexistent target. The fallback resolves only the parent directory and returns the symlink path ...

CVE-2026-112153 vraj404 Criminal-Management-System Officer Registration Form addOfficer.php mysqli_error sql injection

A vulnerability was detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. This affects the function mysqlierror of the file Officers/addOfficer.php of the component Officer Registration Form. Performing a manipulation of the argument...

CVE-2026-112366 Picomatch through 4.0.7 ReDoS via single-branch repeated extglob patterns

Picomatch through 4.0.7 contains a regular expression denial of service vulnerability that allows attackers to block the event loop by supplying single-branch repeated extglob patterns. Attackers can provide globs like + or +a, which analyzeRepeatedExtglob in lib/parse.js skips, causing exponenti...

CVE-2026-112310 docling-core 2.5.0 before 2.103.0 Local File Disclosure via Plain Path ImageRef

docling-core 2.5.0 before 2.103.0 contains a local file disclosure vulnerability that allows attackers to read local images by supplying plain filesystem paths in ImageRef URIs, bypassing the allowimagefileuri gate. Attackers can submit crafted DoclingDocument JSON or YAML that, when exported wit...

CVE-2026-112363 Crawl4AI 0.8.7 through 0.9.5 SSRF Bypass via SSLCertificate.from_url URL Userinfo

Crawl4AI from 0.8.7 through 0.9.5 contains a server-side request forgery vulnerability in the Docker API server that allows unauthenticated attackers to bypass destination checks via URL userinfo parsing differences. Attackers can set fetchsslcertificate=true with crafted userinfo URLs so...

CVE-2026-112308 crewai-tools through 1.15.28 SSRF via SeleniumScrapingTool

crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validateurl private-address check. Attackers influencing agent tool input through prompt injection can direct...

CVE-2026-112307 sqlparse through 0.6.0 PHP Code Injection via output_format='php'

sqlparse through 0.6.0 contains a PHP code injection vulnerability that allows attackers to inject PHP expressions by supplying SQL text containing unescaped dollar signs. Attackers can embed $expr or $expr sequences that OutputPHPFilter places in double-quoted strings, executing arbitrary PHP co...

CVE-2026-112306 NocoBase plugin-collection-sql through 2.2.28 SQL Injection via sqlCollection:setFields

NocoBase @nocobase/plugin-collection-sql through 2.2.28 contains an SQL injection vulnerability that allows privileged users to store unvalidated SQL by bypassing checkSQL through the sqlCollection:setFields action. Attackers holding the collection-sql snippet can replace a benign collection quer...

CVE-2026-112305 Semaphore UI through 2.19.16 RCE via Task Environment Ansible Variable Override

Semaphore UI through 2.19.16 contains a remote code execution vulnerability that allows users with the taskrunner role to override protected Ansible variables by supplying arbitrary keys in the task environment JSON. Attackers can POST tasks setting ansiblesshcommonargs with a ProxyCommand or...

CVE-2026-112303 GDevelop through 5.6.284 Cookie Leak via LocalFileDownloader Resource URLs

GDevelop desktop app through 5.6.284 contains a credential leak vulnerability that allows attackers to steal the gdresource cookie by supplying attacker-controlled resource URLs in project files. Attackers can get victims to open a crafted project, causing downloadLocalFile to send the cookie to...

CVE-2026-112152 vraj404 Criminal-Management-System Search searchOff.php mysqli_query sql injection

A security vulnerability has been detected in vraj404 Criminal-Management-System up to 2808d057e7ddc5295519a487365b0cacfd0ba8c4. Affected by this issue is the function mysqliquery of the file Officers/searchOff.php of the component Search Page. Such manipulation of the argument Search leads to sq...

CVE-2026-109433 Camunda Broken Access Control via Cockpit

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows authenticated attackers to bypass permission checks due to an inverted comparison logic in AbstractCockpitPluginResource.isPermissionDisabled. Attackers with...

CVE-2026-109432 Camunda Expression Injection via orQueries RCE

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the...