CVE-2026-84859

ScadaLTS 2.8.1-release-candidate build 0 is affected by an authenticated blind SQL injection in the /api/events/search endpoint. The sortBy array values in the JSON request body are concatenated directly into the SQL ORDER BY clause without sanitization or parameterization, enabling time-based an...

CVE-2026-84858

ScadaLTS 2.8.1-release-candidate build 0 is vulnerable to Authenticated Remote Code Execution via a scripting sandbox bypass. The DWR "DataSourceEditDwr" class exposes the "validateScript" method, which compiles and executes attacker-supplied JavaScript through the Rhino scripting engine without ...

CVE-2026-63127

RMCP is the official Rust SDK for the Model Context Protocol . Prior to version 2.0.0 , the rmcp crate's OAuth implementation in crates/rmcp/src/transport/auth.rs omits the RFC 9728 resource field from ResourceServerMetadata and allows discover_oauth_server_via_resource_metadata to use protected-...

CVE-2026-63128

RMCP , the official Rust SDK for the Model Context Protocol, has an unauthenticated denial-of-service vulnerability in its stateful Streamable HTTP server (crates/rmcp/src/transport/streamable_http_server/tower.rs). Prior to version 2.0.0 , StreamableHttpService::handle_post calls LocalSessionMan...

CVE-2026-77409

RabbitMQ amqp091-go , a Go AMQP 0.9.1 client, is vulnerable to denial of service prior to 1.13.0 . The root cause is that Channel.dispatch, confirms.confirm, and Connection.dispatch0 synchronously send publisher confirmations, flow-control events, consumer cancellations, returned messages, and co...

CVE-2026-77411

RabbitMQ amqp091-go (a Go AMQP 0.9.1 client) is vulnerable to protocol desynchronization and frame injection in versions prior to 1.13.0 . The root cause is in readLongstr (read.go): when a declared AMQP longstr length exceeds 0x7FFFFFFF, the function returns an empty string and a nil error inste...

CVE-2026-92381

PbootCMS up to 3.2.22 contains a cross-site scripting (XSS) vulnerability in the Template Rendering component, specifically in the decode_string function of apps/admin/controller/content/ContentController.php. Manipulation of the Title argument allows a remote attacker with low privileges and req...

CVE-2026-77412

CVE-2026-77412 affects the RabbitMQ amqp091-go client (a Go AMQP 0.9.1 client) prior to version 1.13.0 . The root cause is in readField in read.go, which reads the length of an AMQP byte-array field (type tag x) into a signed int32 and passes the value directly to make for buffer allocation. A ma...

CVE-2026-77405

RabbitMQ amqp091-go (a Go AMQP 0.9.1 client) has a missing TLS minimum version enforcement in tlsConfigFromURI within uri.go. Prior to 1.13.0 , the function creates tls.Config values without setting MinVersion to tls.VersionTLS12. Builds using a Go runtime whose default permits TLS 1.0 or TLS 1.1...

CVE-2026-92570

reNgine through 2.2.0 has an authorization bypass in the GetFileContents API endpoint due to missing role-based permission checks. Any authenticated user with a low-privilege Auditor role can read bundled reconnaissance tool configuration files, exposing third-party API keys for SecurityTrails, S...

CVE-2026-77404

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client library. Prior to 1.13.0 , the URI.String method in uri.go concatenates CertFile, KeyFile, CACertFile, and ServerName values directly into the AMQPS query string without URL-encoding them. If an application accepts a TLS asset path containing ampersan...

CVE-2026-92569

Hippo4j through version 1.5.0 is affected by a server-side request forgery (SSRF) vulnerability in four ThreadPoolController endpoints that fail to validate the clientAddress parameter. Authenticated attackers can supply arbitrary hostnames and ports to trigger outbound GET requests toward intern...

CVE-2026-92567

TDuck survey form through version 5.0 has an authorization bypass in the POST /user/form/data/update endpoint. Authenticated users can overwrite other users' form submission data because the update request lacks ownership validation , and submission identifiers are allocated in narrow ranges that...

CVE-2026-92568

MLRun through version 1.11.0 is affected by a Server-Side Request Forgery vulnerability in the WebhookNotification handler. Authenticated users can update a run with a malicious webhook notification that triggers when the run reaches a terminal state, causing the API server to send arbitrary HTTP...

CVE-2026-92566

DataGear through 6.0.0 contains an unauthenticated server-side request forgery (SSRF) vulnerability in the /dataSet/preview/Http endpoint. By supplying a caller-controlled URI, an attacker can issue GET, POST, PUT, PATCH, or DELETE requests to internal services and cloud metadata endpoints, recei...

CVE-2026-92565

Rallly versions before 4.15.0 contain an information disclosure vulnerability in the polls.get tRPC procedure , which returns scheduled-event invitee names and email addresses to unauthenticated callers. Attackers can obtain a poll's urlId from public invite links to retrieve this sensitive infor...

CVE-2026-77410

RabbitMQ amqp091-go (a Go AMQP 0.9.1 client) is affected by a resource exhaustion vulnerability prior to v1.13.0 . The flaw resides in Channel.recvContent in channel.go, which preallocates the message body slice using the uint64 ch.header.Size value from the AMQP content header without capping it...

CVE-2026-92616

FileRise before version 3.28.0 contains a privilege escalation vulnerability in its WebDAV interface . The root cause is improper session isolation: the WebDAV layer incorrectly inherits elevated privileges from an ambient PHPSESSID cookie rather than enforcing independent stateless authenticatio...

CVE-2026-77406

RabbitMQ amqp091-go (a Go AMQP 0.9.1 client) is affected by a signed-to-unsigned integer casting flaw in Channel.Qos within channel.go. Because the validateQos function is absent, negative values for prefetchCount and prefetchSize are cast directly to uint16 and uint32 fields. A value of -1 wraps...

CVE-2026-77403

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client library. Prior to version 1.13.0, the Connection.openTune function in connection.go fails to enforce the AMQP protocol minimum frame size (frameMinSize of 4096 bytes), accepting a server-advertised FrameMax below this threshold. A malicious or comprom...