CVE-2026-77614

Opencast , an open-source platform for managing educational audio and video content, is vulnerable to session fixation prior to versions 19.7 and 20.2. The default security configuration in etc/security/mh_default_org.xml accepts a client-selected JSESSIONID from the ;jsessionid= URL path paramet...

CVE-2026-92987

roxmltree (a Rust XML parsing library) versions through 0.21.1 are susceptible to a denial-of-service vulnerability caused by quadratic-time attribute and namespace validation during XML parsing, with no imposed limit on attribute count. An attacker can craft an XML document containing tens of th...

CVE-2026-92986

SiYuan before 3.8.4 is affected by a Cross-Site Scripting (XSS) vulnerability in the backlink dock tree , where document titles are rendered as HTML without escaping markup characters. An attacker can set a malicious title via the rename API or crafted notebooks, executing scripts in the Electron...

CVE-2026-92985

SiYuan versions before 3.8.4 are affected by a Cross-Site Scripting (XSS) vulnerability in bookmark labels imported from ".sy" notebook files. The root cause is a failure to escape HTML in bookmark attributes when rendering them in the dock tree . Because SiYuan runs on Electron , injected script...

CVE-2026-92983

InternLM LMDeploy through 0.17.0 is affected by a memory exhaustion vulnerability in its DistServe prefill/decode disaggregation mode . The root cause is that the proxy uses user-facing session IDs instead of internal scheduler keys, causing scheduler sessions to never be released. An unauthentic...

CVE-2026-92984

HUBzero CMS through 2.2.32 is vulnerable to session fixation because its session manager accepts session identifiers from query strings and request variables in addition to cookies (see Manager.php L123-132 ). An unauthenticated attacker can obtain a valid session ID, embed it in a crafted link s...

CVE-2026-88952

AshAuthentication (team-alembic, an Elixir authentication library) contains an improper authentication flaw in its OAuth2 sign-in flow. The UserResolver.resolve/3 function matches an existing account via upsert_identity keys but gates the link solely on the provider's email_verified boolean, neve...

CVE-2026-81453

Dell OpenManage Server Administrator (OMSA) prior to version 11.1.0.3 is affected by a Path Traversal vulnerability that allows a low-privileged attacker with remote network access to gain filesystem access on the target system. The attack requires no user interaction and has low complexity, yiel...

CVE-2026-81829

CVE-2026-81829 is a same-origin SSRF vulnerability in SmallRye JWT 's AwsAlbKeyResolver , used by applications (e.g., Quarkus) to verify JWTs signed by AWS Application Load Balancers. The root cause is that the resolver constructs the key-fetch URL by directly concatenating the attacker-controlle...

CVE-2026-92879

vgmstream (up to revision r2117) is affected by a security flaw in the parse_mus function within src/meta/mus_acm.c . The vulnerability allows a remote attacker to trigger excessive resource consumption through crafted input, resulting in a low availability impact with no confidentiality or integ...

CVE-2026-81443

Dell OpenManage Server Administrator (versions prior to 11.1.0.3 ) is affected by a Server-Side Request Forgery (SSRF) vulnerability. A low-privileged attacker with remote access could exploit this to forge requests on the server side. The assigned CVSS v3.1 score is 6.4 (MEDIUM) with a scope cha...

CVE-2026-81442

Dell OpenManage Server Administrator versions prior to 11.1.0.3 contain an Improper Privilege Management vulnerability. A low-privileged attacker with remote network access could exploit this to achieve information tampering and unauthorized access . The CVSS 3.1 score is 8.1 (HIGH) with vector A...

CVE-2026-92962

vm2 is a JavaScript sandbox for running untrusted code. In versions up to and including 3.11.3 , the defaultSandboxPrepareStackTrace function in lib/setup-sandbox.js builds its output array using prototype-walking index assignment (lines[lines.length] = value) instead of a prototype-bypassing Ref...

CVE-2026-92963

vm2 versions before 3.11.2 fail to properly restrict access to the VM2_INTERNAL_STATE_DO_NOT_USE_OR_PROGRAM_WILL_FAIL global variable. An attacker with network access and no privileges can reach this internal state object through globalThis, allowing retrieval of sensitive sandbox internals . The...

CVE-2026-92961

vm2 before 3.11.6 fails to enforce its bufferAllocLimit cap on ArrayBuffer , SharedArrayBuffer , and TypedArray constructors. Attackers can exploit this by leveraging these V8 intrinsics to allocate arbitrary host process memory, bypassing the intended allocation ceiling and triggering an out-of-...

CVE-2026-92960

vm2 (a Node.js sandboxing library) versions before 3.11.6 fail to restrict access to the os and dns builtins when configured with builtin: ['*']. This allows sandboxed code to read the host process identity and network topology . Critically, an attacker can invoke dns.setServers() to hijack the h...

CVE-2026-71568

BMCtest (part of the OpenShift Metal3/bmctest project) starts Ironic without authentication and TLS during its test execution window. An attacker on the adjacent network who can win the race against bmctest itself could modify Ironic's state, resulting in a high integrity impact . The high attack...

CVE-2026-92959

CVE-2026-92959 affects vm2 (a Node.js sandboxing library) versions prior to 3.11.8 . The vulnerability lies in the incomplete enforcement of the allowAsync: false option in VM and NodeVM. Although localPromise.prototype.then is patched to throw 'Async not available', the sandbox's Promise static ...

CVE-2026-92958

vm2 (a Node.js sandboxing library) versions through 3.11.6 contain a builtin-module denylist bypass in NodeVM . When embedders use the wildcard with negative entries (e.g., -fs), matching is done by exact module name in lib/builtin.js, so fs/promises is not blocked. Sandboxed code can therefore c...

CVE-2026-92957

vm2 (a Node.js sandboxing library) through version 3.11.6 fails to normalize node:-prefixed builtin specifiers when matching negative entries in a NodeVM wildcard require policy. Because deny-list entries are compared by exact string against canonical builtin names, a policy like ['*', '-node:chi...