CVE-2026-86864

pgAdmin 4 (Backup tool) is vulnerable to argument and connection-string injection via the client-supplied database field. Because the value was appended as a bare trailing positional argument to pg_dump, a dash-prefixed value (e.g. --file=/abs/path) was interpreted as an option due to getopt_long...

CVE-2026-86863

pgAdmin 4 (versions 6.2 through 9.17 ) has an authentication bypass in its Webserver authentication mode. The WebserverAuthentication.get_user() method fell back to reading the WEBSERVER_REMOTE_USER value directly from inbound HTTP request headers, allowing any client to assert an arbitrary ident...

CVE-2026-86862

pgAdmin 4 's Restore and Maintenance tools were vulnerable to connection-string injection through the database field, passed directly as --dbname to pg_restore/psql. Because libpq expands a database name containing = into a full connection string, an attacker-supplied value like host=attacker.exa...

CVE-2026-86861

pgAdmin 4 's File Manager save_file endpoint (used by the Query Tool and ERD) contained a TOCTOU race : after validating a path with check_access_permission(), it opened the file with a plain open() call lacking the O_NOFOLLOW protection that the separate upload path had gained in CVE-2026-7819. ...

CVE-2026-92881

vgmstream contains a divide by zero vulnerability in the AWB parser component, specifically in the function init_vgmstream_awb_memory located in src/meta/awb.c. The flaw can be triggered remotely with user interaction (e.g., processing a crafted AWB file), resulting in a low availability impact w...

CVE-2026-56795

Dell Server Update Utility versions prior to 26.07.01 are affected by an Uncontrolled Search Path Element vulnerability. A low-privileged attacker with local access could exploit this to achieve code execution , with a CVSS 3.1 score of 8.2 (HIGH) and a changed scope impacting confidentiality, in...

CVE-2026-85999

CVE-2026-85999 affects Soup Sieve , a CSS selector library used with Beautiful Soup 4, in versions prior to 2.9 . The root cause is a polynomial-time (O(n²)) regular expression in RE_WS_END within selector_iter (src/soupsieve/css_parser.py). An end-anchored whitespace-and-comment expression, used...

CVE-2026-86000

Soup Sieve is a CSS selector library for Beautiful Soup 4. Prior to 2.9 , the selector parser in src/soupsieve/css_parser.py defines IDENTIFIER with adjacent quantified groups over overlapping character classes, and VALUE embeds IDENTIFIER for attribute selectors. An attacker-controlled selector ...

CVE-2026-86040

CVE-2026-86040 affects @libp2p/floodsub in the libp2p JavaScript networking stack, prior to version 11.0.26 . The vulnerability stems from unauthenticated RPC frames on /floodsub/1.0.0 being decoded without protobuf element limits, and the subscription array being processed synchronously without ...

CVE-2026-91039

team-alembic/ash_authentication versions 5.0.0-rc.10 through before 5.0.0-rc.14 are affected by an Authentication Bypass by Spoofing in the dynamic_oidc strategy. The __connection_id__ field is populated only on an ephemeral per-request struct, but DynamicOidc.IdentityChange.change/3 re-fetches t...

CVE-2026-86039

CVE-2026-86039 affects @libp2p/peer-store (part of the JavaScript libp2p networking stack) from versions 8.0.0 through 12.0.24 . The root cause is in consumePeerRecord, which verifies a RecordEnvelope signature but fails to require that PeerRecord.peerId in the signed payload matches the signer p...

CVE-2026-86038

CVE-2026-86038 affects the @libp2p/gossipsub package (versions 15.0.0 through 16.0.5) in the JavaScript libp2p networking stack. The vulnerability resides in validateToRawMessage within the default StrictSign policy: when a claimed author is an RSA peer ID that does not inline a public key, the f...

CVE-2026-93015

BlueKitchen BTstack through 1.8.2 contains an out-of-bounds write in the A2DP stream endpoint discovery path. The vulnerable code in a2dp.c and avdtp.c fails to validate the peer-reported endpoint count against the bounds of a fixed table when processing an AVDTP DISCOVER response. A bonded peer ...

CVE-2026-93014

RosarioSIS versions before 12.9 are affected by a path traversal vulnerability in the filename request parameter within the Users and Students modules. Insufficient validation allows authenticated users to craft parent-directory sequences that escape upload directories and unlink allow-listed fil...

CVE-2026-93013

RAGFlow through 0.27.2 contains a path traversal vulnerability in the dev_insert_chunks_from_file and dev_insert_metadata_from_file endpoints. The root cause is missing path validation on the file_path parameter, which allows authenticated attackers to supply absolute file paths and read arbitrar...

CVE-2026-76834

b2evolution CMS versions 6.7.8 through 7.2.5 contain an incomplete fix for CVE-2016-8901: the function param_check_serialized_array() fails to reject payloads using negative integer array keys . Unauthenticated attackers can submit crafted serialized PHP objects via POST to htsrv/call_plugin.php,...

CVE-2026-12284

Mattermost Desktop App versions

CVE-2026-76781

CVE-2026-76781 is a NULL pointer dereference in libxml2 's XML catalog parsing. When a nextCatalog element lacks its mandatory catalog attribute, the parser dereferences a NULL pointer, causing the application to crash and resulting in a Denial of Service . The attack vector is local with user in...

CVE-2026-75588

Mattermost Desktop App versions

CVE-2026-92880

An out-of-bounds write vulnerability exists in vgmstream (versions up to r2117), specifically in the function vadpcm_read_coefs_be within the file src/coding/vadpcm_decoder.c, part of the EA SCHl parser component. The flaw is triggered by manipulation of the entry/entries argument, allowing a rem...