CVE-2026-61593

djust (a Phoenix LiveView-style reactive server-side rendering library for Django with Rust) is vulnerable to Cross-Site Request Forgery (CSRF) on its Server-Sent Events (SSE) transport prior to version 1.0.7 . The root cause: SSE POST endpoints were @csrf_exempt, the SSE GET stream endpoint lack...

CVE-2026-19607

A flaw in the first-broker-login flow of the keycloak-services component in Red Hat build of Keycloak allows an attacker to register a matching username on an external identity provider, triggering a username collision that locks out the legitimate user. The root cause is insufficient validation ...

CVE-2026-17526

CVE-2026-17526 is a privilege escalation vulnerability in Keycloak (open-source identity and access management), specifically in the keycloak-services component. A user holding the impersonation role can impersonate a realm administrator , gaining full administrative control over the realm—includ...

CVE-2026-90999

Sentry Seer , the automated debugging assistant within the Sentry error-monitoring platform, is vulnerable to a multi-stage trust-boundary violation that enables unauthenticated remote code execution . When Seer is configured to automatically hand issues to a coding agent, an attacker can submit ...

CVE-2026-92397

Ruijie RG-EW3000GX (firmware EW_3.0(1)B11P380) is affected by an OS command injection vulnerability in the configChange component, specifically in the cc_set function of the binary unifyframe-sgi.elf . The root cause is the unsanitized data.url argument, which allows a remote authenticated attack...

CVE-2025-59953

LMDeploy (by InternLM ), a toolkit for compressing, deploying, and serving large language models, is affected by a remote code execution vulnerability in versions 0.9.1 through 0.10.1 . The root cause lies in the AsyncRPCServer component (zmq_rpc.py), where the call_and_response() function direct...

CVE-2026-61595

djust prior to 1.0.7 provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Multi-tenant isolation was enforced only on the HTTP path: the current tenant was stored in threading.local() and set exclusively by the HTTP-only TenantMiddleware. On the...

CVE-2026-92626

Control iD iDSecure versions prior to 4.8.3.0 are vulnerable to an unauthenticated Denial of Service (CVSS 7.5 HIGH). The root cause lies in the /api/dguardintegration/dguardVersion endpoint, which dereferences a DGuard integration login state that may be unset, raising an unhandled null referenc...

CVE-2026-92625

Control iD iDSecure versions prior to 4.8.3.0 are vulnerable to an unauthenticated Denial of Service via the /api/license/restartService endpoint. This endpoint is reachable without authentication and invokes an internal routine that terminates the iDSecure service process and relaunches it via a...

CVE-2026-92615

flightctl 's configureRepoHTTPSClient() function in the device-render worker builds a per-repository tls.Config (which may include InsecureSkipVerify , a custom CA bundle, or tenant-supplied mTLS client certificates ) and installs it into go-git's process-global client.Protocols map via gitclient...

CVE-2026-92218

A Server-Side Template Injection (SSTI) vulnerability was identified in the release-service-utils component. The root cause is that templates are processed twice (double expansion), allowing a malicious tenant to inject Jinja syntax into input fields that is interpreted on the second pass. This b...

CVE-2026-70416

Dell ObjectScale versions prior to 4.4.0.0 contain a Deserialization of Untrusted Data vulnerability that allows an unauthenticated remote attacker to achieve Remote Code Execution (RCE) . The flaw is rated CVSS 10.0 (CRITICAL) with a network attack vector, low complexity, and changed scope, yiel...

CVE-2026-92627

A heap-use-after-free vulnerability exists in H5T__conv_f_f() in src/H5Tconv.c of HDF5 versions before 1.14.2 . When converting a compound datatype containing floating-point members during a dataset read, a temporary buffer allocated with calloc() is freed and subsequently read from within the sa...

CVE-2026-92385

A Cross-Site Scripting (XSS) vulnerability exists in SourceCodester Online Food Ordering System version 1.0 , specifically in the file /admin/update_category.php (component: Category Update). The affected function is not publicly identified. An attacker with high privileges (i.e., an authenticate...

CVE-2026-76104

Dell ObjectScale versions prior to 4.4.0.0 contain an Incorrect Permission Assignment for Critical Resource vulnerability in the OS. A high-privileged attacker with remote access could exploit this flaw to cause Denial of Service . The CVSS 3.1 score is 5.5 (Medium) , reflecting high privileges r...

CVE-2026-26947

Dell ECS (versions 3.8.1.0 through 3.8.1.7) and Dell ObjectScale (versions prior to 4.4.0.0) contain an Improper Privilege Management vulnerability. A high-privileged attacker with local access can exploit this to achieve elevation of privileges , with full impact on confidentiality, integrity, a...

CVE-2025-43936

Dell ObjectScale, versions prior to ObjectScale 4.4.0.0, contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access...

CVE-2025-36591

Dell ECS (versions 3.8.1.0 through 3.8.1.7) and Dell ObjectScale (versions prior to 4.4.0.0) contain a Use of a Broken or Risky Cryptographic Algorithm vulnerability. A high-privileged attacker with local access could potentially exploit this flaw, leading to information exposure . The assigned C...

CVE-2026-92383

CVE-2026-92383 is a cross-site request forgery (CSRF) vulnerability in PbootCMS versions up to 3.2.24 , affecting the UserController::del and UserController::mod functions within the User Management component (apps/admin/controller/system/UserController.php). A remote attacker with no privileges ...

CVE-2026-82410

Pocketbase , an open-source web backend written in Go, is vulnerable to a denial of service due to its panic-recovery middleware failing to cover internal child and worker goroutines. A panic in one of these internal goroutines can escape recovery and terminate the server process . The fix, intro...