CVE-2026-92454 JPEG decoder: truncated segments are read past the image buffer, and a zero sampling factor hangs the decode

The GUIX software JPEG decoder reads four kinds of marker segment without checking that each is long enough to hold what it reads. A truncated segment is therefore read past the end of the caller's image buffer. Separately, a zero chroma sampling factor makes the block decode loop non-terminating...

CVE-2026-112944 launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, when an attacker can create a filesystem entry beginning with plus or minus in the working directory, an affected editor is selected, and the path can remain relative or is converted to a relative...

CVE-2026-91059 JPEG decoder: a duplicate SOF0 after SOS publishes a pixelmap that misreports its own allocation size

The GUIX JPEG software decoder enforces no ordering on JPEG markers. A file that places a second SOF0 frame header after SOS re-runs the frame header parser after the output buffer has already been allocated and its geometry latched. The decoder returns GXSUCCESS and publishes a GXPIXELMAP whose...

CVE-2026-91189 GUIX binary resource loader: unvalidated glyph range causes an integer underflow and a heap out-of-bounds write when loading an untrusted font or theme

The GUIX binary resource loader never checks that a font page's glyph range is well formed. gxpageheaderfirstglyph and gxpageheaderlastglyph are read verbatim from the file and only the upper bound of lastglyph is validated, so a page declaring firstglyph lastglyph makes last - first + 1 underflo...

CVE-2026-112943 launch-editor: escapeCmdArgs() omits % escaping on Windows

launch-editor allows users to open files with line numbers in editor from Node.js. Prior to 2.14.2, launch-editor did not escape % on Windows when passing an argument to cmd. When an environment variable contained a malicious value, it was possible that that content to be executed. This...

CVE-2026-112833 WordPress Seriously Simple Podcasting plugin <= 3.17.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Stored XSS.This issue affects Seriously Simple Podcasting: from n/a through 3.17.0...

CVE-2026-92446 GUIX binary resource loader reads past the end of a resource, because no length for it ever reaches the loader

gxbinresthemeload and gxbinresfontload take the resource as a bare GXUBYTE with no length, and GXBINRESDATAINFO has no field to carry one. Every read is therefore performed at an offset the file itself chose, against a buffer whose extent the loader does not know. A resource that declares more da...

CVE-2026-92449 Binary resource loader: unbounded map_id from a theme file causes a heap out-of-bounds write in the GUIX-allocated arena

gxbinrespixelmaptableload in the GUIX binary resource theme loader indexes the pixelmap table with a value read verbatim from the resource file and never bounds it against the table size. A crafted theme drives a write of up to roughly 256 KB past the end of the table. The overflowed buffer is...

CVE-2026-91186 PNG decoder: a duplicate IHDR chunk after IDAT resizes the image after allocation, causing a heap out-of-bounds write

The PNG chunk reader has no notion of chunk ordering. It records whether an IDAT has been seen and whether a tRNS has already supplied transparency, but nothing prevents an IHDR being read a second time. A PNG carries exactly one IHDR and it is the first chunk. A file that places a second one aft...

CVE-2026-113466 MinIO Embedded Console common-main.go SessionTokenAuthenticate hard-coded key

A security vulnerability has been detected in MinIO up to RELEASE.2025-10-15T17-29-55Z. This issue affects the function globalDeploymentID/SessionTokenAuthenticate of the file cmd/common-main.go of the component Embedded Console. Such manipulation leads to use of hard-coded cryptographic key . It...

CVE-2026-92162 Flatpak vulnerable to path traversal via unvalidated "arch" parameter in DeployAppstream

Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. Prior to version 1.18.1, on systems where at least one OCI remote is configured most common on Fedora systems, a malicious local user in an active local session could use a crafted architecture na...

CVE-2026-112939 filelock: SoftFileLock removes a live holder's marker when another user forges the PID in a writable marker

filelock is a platform-independent file lock for Python. From 3.22.0 until 4.2.1, SoftFileLock can trust a forged process identifier in a marker that an attacker can modify but cannot remove, allowing an authorized contender such as another process of the holder's account or root to act as a...

CVE-2026-95111 Module queue front-send validates a word count as a byte count

A memory-protected ThreadX module's queue request reaches the Module Manager's dispatch layer, which decides how much of the module's buffer the privileged queue copy may touch and hands that extent to the module port's range check. A queue's txqueuemessagesize is a count of ULONGs and the copy...

CVE-2026-96402 USBX PIMA/MTP host class reads past its receive buffer when a device over-reports its object handle count

A malicious USB MTP/PTP device can cause the USBX host to read past a heap buffer during ordinary object enumeration, leaking adjacent heap contents to the application or faulting on an unmapped page...

CVE-2026-112915 filelock ReadWriteLock: a crafted lock database makes every acquire stall or hang regardless of timeout

filelock is a platform-independent file lock for Python. From 3.20.4 until 4.2.1, ReadWriteLock can open a crafted SQLite lock database without bounding schema and query work, allowing another local user who can replace the database to make acquisition stall or hang; versions from 3.20.4 expose...

CVE-2026-112912 filelock: Symlink swap during SoftFileLock's writability check leaks whether a path exists and is writable by the lock taker

filelock is a platform-independent file lock for Python. From 3.32.6 until 4.2.1, SoftFileLock can follow a swapped symbolic link during the conditional os.access writability check for a node without its owner-write bit, allowing another local user on a platform and directory configuration that...

CVE-2026-113397 DrayTek Vigor2960 IPsec mainfunction.cgi ruequest_certificate command injection

A security vulnerability has been detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function ruequestcertificate of the file /cgi-bin/mainfunction.cgi of the component IPsec Handler. Such manipulation of the argument option leads to command injection. The attack can be launche...

CVE-2026-112906 filelock: SoftFileLock evicts a fresh lock file whose watched age another local user's pre-dated file passed on through inode reuse

filelock is a platform-independent file lock for Python. From 4.1.0 until 4.2.1, SoftFileLock versions from 4.1.0 can reuse a stale observation when an attacker pre-dates and removes its own marker, at least two lock-user processes are waiting, coarse or matching modification times preserve the...

CVE-2026-97400 jdmpview / DTFJ reads arbitrary local files and makes arbitrary outbound requests when opening a third-party diagnostic dump bundle (XXE in XMLIndexReader)

In Eclipse OpenJ9 versions up to 0.63, opening a supplied diagnostic dump bundle with the jdmpview tool, or equivalent DTFJ code, may cause the analyst's machine to read an arbitrary local file named inside the bundle and send its contents to an arbitrary remote host...

CVE-2026-103119 Apache Tomcat: AJP response mix-up

Buffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the current request and the next request received on that connection leading most likely to failure of the second request and possibly leakage of data from...

CVE-2026-113395 DrayTek Vigor2960 swmconfigupload mainfunction.cgi cgiEscape path traversal

A security flaw has been discovered in DrayTek Vigor2960 1.5.1.6 Revision 8218. The affected element is the function cgiEscape of the file /cgi-bin/mainfunction.cgi of the component swmconfigupload. The manipulation of the argument multipart results in path traversal. It is possible to launch the...

CVE-2026-96406 VIDEO class descriptor walk consumes device-controlled wTotalLength as its bound

A VideoStreaming interface reports the size of its whole class-specific descriptor block in the wTotalLength field of its input header. The USBX host recorded that figure and used it as the budget for walking the format, frame and frame-interval descriptors, without holding it against the...

CVE-2026-113393 DrayTek Vigor2960 commonupload mainfunction.cgi unrestricted upload

A vulnerability was determined in DrayTek Vigor2960 1.5.1.6 Revision 8218. This issue affects some unknown processing of the file /cgi-bin/mainfunction.cgi of the component commonupload. Executing a manipulation of the argument uploadpath/uploadname can lead to unrestricted upload. The attack may...

CVE-2026-96582 Out-of-bounds Read via Check-after-use in the USBX HID Report Descriptor Parser

A HID report descriptor is a sequence of items, each declaring in its header how many data bytes follow. The USBX host walks that sequence by advancing over each header and parsing the data behind it. The walk checked that an item fitted in the descriptor only after it had advanced past the heade...

CVE-2026-91041 FileX fault-tolerant log replay writes past the destination sector when mounting a crafted FAT image

Mounting an attacker-controlled FAT image with fault tolerance enabled causes an out-of-bounds heap write during log replay. The write is attacker-positioned and attacker-valued, and on a common embedded memory layout it reaches the FXMEDIA driver callback, giving control of the instruction point...

CVE-2026-105941 Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname

The Azure Key Vault KMS provider in Kroxylicious accepts an untrusted vaultName from wire-deserialized EDEK bytes without format validation, enabling SSRF that exfiltrates the proxy's Azure bearer token to an attacker-controlled host. Token replay against the real Key Vault defeats the entire...

CVE-2026-113401 Denial-of-service in the PDF Viewer component

Denial-of-service in the PDF Viewer component. This vulnerability was fixed in Firefox 158.0.1...

CVE-2026-113400 Uninitialized memory in the Audio/Video: cubeb component

Uninitialized memory in the Audio/Video: cubeb component. This vulnerability was fixed in Firefox 158.0.1...

CVE-2026-113470 Cryptographic issue in the Security Block-lists, Allow-lists, and other State component

Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if RemoteSettings is...

CVE-2026-113391 DrayTek Vigor2960 Upload Endpoint mainfunction.cgi uploadlangs command injection

A vulnerability has been found in DrayTek Vigor2960 1.5.1.6 Revision 8218. This affects the function uploadlangs of the file /cgi-bin/mainfunction.cgi of the component Upload Endpoint. Such manipulation leads to command injection. The attack can be executed remotely. The exploit has been disclose...

CVE-2026-113620 Eclipse ioFog operator WebSocket accepts an unverified JWT

In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, operator WebSocket upgrades on the exec and log routes do not verify the bearer JWT. The payload is decoded and its groups or roles are used as RBAC subjects. A self-minted token whose groups contain admin matches the built-in admin role,...

CVE-2026-113619 Eclipse ioFog renders request templates before authentication

In Eclipse ioFog Controller versions 3.8.0 through 3.9.1, POST, PUT, and PATCH bodies on routes that enable template substitution are rendered by an uncapped Liquid engine before authentication and RBAC. The bearer check does not reject a missing or invalid token, and the auth rate limit applies...

CVE-2026-113389 DrayTek Vigor2960 CGI Process mainfunction.cgi set_table command injection

A vulnerability was detected in DrayTek Vigor2960 1.5.1.6 Revision 8218. Affected by this vulnerability is the function settable of the file /cgi-bin/mainfunction.cgi of the component CGI Process. The manipulation of the argument sectiontype results in command injection. The attack may be launche...

CVE-2026-18205 XSS in Ticimax Informatics' Ticimax E-Commerce Platform

Improper neutralization of input during web page generation 'cross-site scripting' vulnerability in Ticimax Informatics Technologies Inc. Ticimax E-Commerce Platform allows Reflected XSS. This issue affects Ticimax E-Commerce Platform: through 2026-09-02...

CVE-2026-113385 LeeDrOiD Labs Shortcutter 2 App ToggleGeneric.java Class.forName improper export of android application components

A vulnerability has been found in LeeDrOiD Labs Shortcutter 2 App 9.0.48 on Android. This issue affects the function Class.forName of the file ToggleGeneric.java. The manipulation of the argument Class leads to improper export of android application components. Local access is required to approac...

CVE-2026-113495 Cockpit-machines: rhsm access-token disclosure through image helper command-line arguments

A flaw was found in cockpit-machines. Red Hat Subscription Management RHSM authentication tokens are passed as command-line arguments to background helper processes during image retrieval operations. A local, unprivileged attacker on a system permitting cross-user process inspection can view thes...

CVE-2026-14933 Unblu Spark Cross-Site Scripting in Embedded Co-Browsing

Cross-site scripting in the embedded co-browsing feature in Unblu inc. Unblu Spark 7.0 through 7.57.7 and 8.0 through 8.39.2, on on-premises and cloud deployments, allows an unauthenticated remote attacker in the visitor role to execute arbitrary JavaScript in the browser of an agent taking part ...

CVE-2026-9589 Unblu Spark Authorization Bypass in Configuration Cascade Operations

Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and change configuration properties of entities they aren't...

CVE-2026-113383 Optimal IdM OptimalCloud Login cross site scripting

A vulnerability was detected in Optimal IdM OptimalCloud 5.0. This affects an unknown part of the file /v5.0/webapps/pages/public/Login. Performing a manipulation of the argument tz results in cross site scripting. Remote exploitation of the attack is possible. The vendor was contacted early abou...

CVE-2026-113358 LavaLite CMS through 10.1.2 Missing Authentication via Filer Download Routes

LavaLite CMS through 10.1.2 contains a missing authentication vulnerability in the Filer module that allows unauthenticated attackers to download stored files through the filer/download and filer/display routes. Attackers can supply arbitrary disk names and paths to FileController to retrieve...

CVE-2026-113357 @e2e-dev/github before 0.4.1 CI Report Hijacking via Predictable Comment Marker

@e2e-dev/github before 0.4.1 contains an improper authorization vulnerability that allows pull request commenters to hijack CI test reports by posting comments with the predictable marker. Because findComment and upsertComment in post.ts never check the comment author, attackers can receive resul...

CVE-2026-113355 Chatwoot before 4.14.0 Stored XSS via Help Center Video Embed Links

Chatwoot before 4.14.0 contains a stored cross-site scripting vulnerability that allows account administrators to inject JavaScript by crafting video-embed links in Help Center articles. Attackers can use angle-bracket link destinations with double quotes to break out of the unescaped iframe src...

CVE-2026-113352 uTox through 0.18.1 Path Traversal via Auto-Accepted File Transfers

uTox through 0.18.1 contains a path traversal vulnerability that allows Tox friends to write arbitrary files by sending absolute or ../ file names to victims with auto-accept enabled. Attackers can overwrite shell startup files or plant crafted .ftinfo resume records that ftfindresumeable loads,...

CVE-2026-113353 LearnPress before 4.4.10 Missing Authorization via Legacy Editor AJAX Handlers

LearnPress before 4.4.10 contains a missing authorization vulnerability in the admincourseeditor, adminquizeditor and adminquestioneditor lp-ajax actions, allowing instructors to modify other instructors' content. Authenticated instructors can reuse their own generic editor nonce with another...

CVE-2026-113350 react-admin before 5.15.5 Stored XSS via UrlField and FileField

react-admin before 5.15.5 contains a stored cross-site scripting vulnerability that allows attackers to inject scripts by storing javascript: URIs in record fields rendered by UrlField and FileField. Attackers who can influence URL-type backend fields can execute JavaScript in an administrator's...

CVE-2026-112787 OpenCATS before 0.10.0 Missing Authorization in Reports Module EEO Reports

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest that allows authenticated users to view EEO demographic reports without the canSeeEEOInfo permission. Attackers can invoke the customizeEEOReport and generateEEOReportPreview actions to view aggregat...

CVE-2026-112786 OpenCATS before 0.10.0 Missing Authorization via Import Revert Action

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportUI::handleRequest that allows low-privileged authenticated users to roll back data imports. Attackers with READ-level access can request the import module's revert action with an importID to mass-delete imported...

CVE-2026-112784 OpenCATS before 0.10.0 Missing Authorization via ajax/testEmailSettings.php

OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to send mail through the configured SMTP relay. Read-level users can supply testEmailAddress and fromAddress parameters to send the fixed test message to any...

CVE-2026-108089 Apache Cocoon: Unauthenticated access to diagnostic interfaces

UNSUPPORTED WHEN ASSIGNED Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An unauthenticated user could gain access to diagnostic interfaces, including triggering of cache, exposure of verbose debug logging and profile information. This...

CVE-2026-107597 jwks_uri from the OIDC discovery document is fetched without checking its origin or scheme

PIA's token verification verifytoken in pia/oidc.py fetches the OIDC discovery document of an allowlisted issuer and then follows the jwksuri contained in that response without parsing it as a URL, comparing it against the approved issuer's origin, or requiring HTTPS — the only check is that the...