CVE-2026-82439

CVE-2026-82439 affects the DRPC server in Apache Storm . The root cause is an unbounded memory leak: the DRPC server maintained a map from client-supplied function names to request queues, but no code path ever removed an entry. Since function names are unconstrained by registered topologies, an ...

CVE-2026-90788

A remote OS command injection vulnerability affects the Template Handler component of magicblack MacCMS10 (version 2026.1000.4055), specifically via manipulation of the file admin1.php/admin/template/index/path/.%40template%40default%40html%40label.html. The attack requires high privileges (authe...

CVE-2026-82920

Mattermost versions 11.9.x ≤ 11.9.0 , 11.8.x ≤ 11.8.4 , and 11.7.x ≤ 11.7.7 fail to enforce authorization boundaries on the ABAC policy update endpoint. A channel or team administrator can detach a system-assigned ABAC parent policy by sending a crafted PUT /api/v4/access_control_policies request...

CVE-2026-82441

Apache Storm Nimbus accepts unvalidated dependency_jars and dependency_artifacts key lists from topology submissions, leading to two distinct issues. First, during topology cleanup Nimbus deletes the listed keys under its own subject (bypassing the blobstore ACL check), so a submitter can delete ...

CVE-2026-90941

novel-plus through 5.3.3 contains an authorization bypass in the BookController download endpoint , allowing authenticated backend accounts to export complete book text—including paid chapters —by supplying a bookId and bookName , without VIP or purchase verification. The vulnerability bypasses t...

CVE-2026-90940

novel-plus through version 5.3.3 contains an insecure default cache-management password in the CacheController.refreshCache endpoint. The hardcoded default value is exposed in the URL path, allowing anonymous attackers (no privileges required) to trigger unauthorized portal cache invalidation. Th...

CVE-2026-90939

novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint, which lacks proper permission annotations . Authenticated attackers can retrieve password hashes and personal data (email addresses, phone numbers) for users within their data scope, enabling...

CVE-2026-84179

Apache Storm (Nimbus component and Storm UI) is affected by an information disclosure vulnerability in getTopologyPageInfo, which merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the topology_conf field. The Storm UI copied ...

CVE-2026-86348

CVE-2026-86348 affects the MS Calendar plugin for Mattermost (versions ≤11.9, 11.0.9, 11.4.8, 11.7.7, and 10.22.11.0). The plugin fails to recover from handler panics triggered by a post-action request containing an unexpected field type , allowing an authenticated user to crash the plugin proces...

CVE-2026-86349

Mattermost server versions 11.9.x ≤ 11.9.0, 11.8.x ≤ 11.8.4, 11.7.x ≤ 11.7.8, and 10.11.x ≤ 10.11.22 are affected by an algorithmic denial of service in the server-side Markdown parser. The root cause is a failure to limit nesting depth , allowing an authenticated attacker to exhaust CPU resource...

CVE-2026-90787

A vulnerability in Soarkey StudentManagement (up to commit e08f7f1d5015af407aa4cca0ada3dea189b4937e) affects the Registration Workflow component. The root cause is improper privilege management in the RegisterServlet.doPost function of code/WebContent/register.html, triggered by manipulation of t...

CVE-2026-90786

Dvidelabs flatcc (up to version 0.6.3 ) contains a vulnerability in the Duplicate Symbol Handler component, specifically in the align_order_members function within src/compiler/semantics.c. The flaw allows a reachable assertion to be triggered via crafted input. The attack can be initiated remote...

CVE-2026-73191

Apache Syncope is affected by a URL Redirection to Untrusted Site (Open Redirect) vulnerability in its SRA module when configured for CAS authentication . The root cause is that the target Apereo CAS instance's URL is calculated by unconditionally trusting client-supplied Forwarded HTTP headers ,...

CVE-2026-7208

Yealink SIP-T33G IP phones running firmware 124.86.x.x (prior to 124.87.0.0 ) are affected by a race condition in the runtime diagnostic subsystem. An authenticated attacker can trigger a diagnostic operation such as traceroute or ping and concurrently invoke the file-deletion endpoint to remove ...

CVE-2026-73195

Apache Syncope is affected by an Improper Encoding or Escaping of Output vulnerability in its CSV export functionality. Authenticated users can store a spreadsheet formula payload in one of their own plain attributes; when those users are included in a CSV export and the resulting file is opened ...

CVE-2026-73236

Apache Syncope is vulnerable to a cross-realm authorization bypass in its delegated administration feature. Security checks that rely on prefix matching of Realm names fail to distinguish two sibling Realms sharing a common name prefix, allowing an unauthenticated network attacker to gain incorre...

CVE-2026-90961

MISP ≤2.5.45 contains an authentication bypass in the LdapAuth and LinOTPAuth plugins. Both replace CakePHP's FormAuthenticate but omit its _checkFields() validation guard, allowing empty or non-string credentials to reach downstream logic. In the LDAP authenticator, an empty password forwarded t...

CVE-2026-90949

CVE-2026-90949 affects GIMP's PSP (Paint Shop Pro) file loader . When processing a compressed selection channel , a heap-based buffer overflow occurs due to a mismatch between the allocated buffer size and the amount of decompressed data. An attacker can craft a malicious PSP file that, when open...

CVE-2026-90948

GIMP's ICO file loader is vulnerable to a heap-based buffer overflow triggered by an integer overflow when calculating the buffer size for an embedded PNG image within an ICO file. The undersized allocation causes decoded pixel data to overflow the buffer, potentially enabling arbitrary code exec...

CVE-2026-90785

A reachable assertion vulnerability exists in the analyze_struct function (file src/compiler/semantics.c, component Struct Analysis) of Dvidelabs flatcc up to version 0.6.3. A remote, unauthenticated attacker can trigger the assertion, causing an availability impact (denial of service). The explo...