CVE-2026-92214

CVE-2026-92214 affects a2ui-project a2ui versions up to 0.10.7 , specifically the file sanitizer-markdown-renderer-service.ts within the a2a-chat-canvas Angular component. The vulnerability is a Cross-Site Scripting (XSS) flaw in an unknown function of that service. A remote attacker with low pri...

CVE-2026-92213

a2ui-project a2ui (versions up to 0.10.6) is affected by an injection vulnerability in the Angular Renderer component. The vulnerable code is located in the function z.any within the file renderers/web_core/src/v0_9/schema/server-to-client.ts. By manipulating the primaryColor argument, a remote a...

CVE-2025-56566

MikroTik firmware 7.19.4 stores sensitive authentication credentials and network state in cleartext within non-volatile storage (SPI flash). An attacker with physical access to the device can extract this material via an SPI flash dump, without authenticating to the device or knowing the administ...

CVE-2026-38999

CVE-2026-38999 is a Null Pointer Dereference in the mk_sched_event_close function (located in mk_server/mk_scheduler.c) of Monkey , an HTTP server and reverse proxy, affecting versions through commit 4fb0c16. An attacker can trigger a Denial of Service (DoS) by sending a crafted HTTP request to t...

CVE-2026-51990

Sogou Input Method (Tencent) for Windows below version 16.3.0.3498 is vulnerable to remote code execution via the biz_helper.exe component. The attack chain involves an unvalidated sgbiz: URI protocol handler passing attacker-controlled arguments to SGMyInput.exe, which instructs the embedded Chr...

CVE-2026-88592

kkFileView versions 4.2.0 and above are vulnerable to a Server-Side Request Forgery (SSRF) in the /getCorsFile cross-origin file proxy endpoint. The root cause is a parameter mismatch : TrustHostFilter validates the first non-empty parameter in a fixed priority order, while the controller only re...

CVE-2026-92207

CVE-2026-92207 corresponds to a code injection vulnerability in MindsDB , specifically within the OpenBBtable class . The flaw arises from insufficient validation of a user-supplied string before it is used to execute Python code, allowing an authenticated remote attacker to achieve Remote Code E...

CVE-2026-92205

CVE-2026-92205 affects the libarchive component of BusyBox . The flaw is a symlink directory traversal that allows remote attackers to create arbitrary files in the context of the current user. The root cause is the lack of proper validation of a user-supplied path before it is used in file opera...

CVE-2026-92206

CVE-2026-92206 (tracked as ZDI-26-706 ) affects the CrewAI crewAI Framework . The flaw resides in the load_agent_from_repository function, which does not properly restrict a user-supplied argument before using it to import a module, enabling remote code execution in the context of the service acc...

CVE-2026-92208

NoMachine is vulnerable to a heap-based buffer overflow in the parsing of mDNS resource records . The root cause is the lack of proper length validation on user-supplied data before it is copied to a heap-based buffer. A network-adjacent attacker can exploit this flaw without authentication to ac...

CVE-2025-56563

CVE-2025-56563 is a Server-Side Request Forgery (SSRF) vulnerability in sat_proxy.php of Zenith Satellite Tracker 1.0 . The script accepts an attacker-controlled address URL parameter and passes it to curl_setopt(CURLOPT_URL) without host or scheme validation , allowing an unauthenticated remote ...

CVE-2026-88593

kkFileView versions 5.0.0 through 5.0.2 are affected by a reflected XSS vulnerability in the /onlinePreview endpoint. The OnlinePreviewController passes user-controlled page and kkagent request parameters to FreeMarker templates without sanitization, and those templates insert the values directly...

CVE-2026-92203

CVE-2026-92203 is a Server-Side Request Forgery (SSRF) vulnerability in Airbyte's SharePoint Connector , specifically in the _get_shared_drive_object method. The flaw stems from the lack of proper URI validation before accessing resources, allowing a remote authenticated attacker to initiate arbi...

CVE-2026-92210

CVE-2026-92210 corresponds to ZDI-26-712 , a Server-Side Request Forgery (SSRF) leading to information disclosure in NoMachine . The flaw resides in the nxhtd web service , which listens on UDP port 4443 by default, and stems from insufficient validation of a URI before accessing resources. A rem...

CVE-2025-56565

DD-WRT firmware running on TP-Link TL-WR740N v1–v4 routers stores sensitive authentication credentials in cleartext within non-volatile memory (SPI flash). The exposed material includes SSH private keys , dynamic DNS passwords , email notification credentials , and administrative passwords . An a...

CVE-2026-79298

CVE-2026-79298 is an incomplete remediation of the UEFI Secure Boot bypass originally disclosed as CVE-2024-7344 in Howyar SysReturn (NetCopy feature). While the x64 boot path was fixed, the IA-32 boot path (BOOTia32.efi) retained the same custom RxPE PE loader, the same bypassed Secure Boot veri...

CVE-2026-92209

CVE-2026-92209 affects NoMachine , where an improper authentication flaw exists in the Redis database access mechanism. The root cause is insufficient entropy in credential generation, allowing a local attacker with low-privileged code execution to escalate privileges and run arbitrary code in th...

CVE-2026-92204

CVE-2026-92204 affects Airbyte , specifically its OneDrive Connector . The vulnerability is a Server-Side Request Forgery (SSRF) in the _get_shared_drive_object method, caused by the lack of proper validation of a URI before accessing resources. A remote attacker with valid authentication can ini...

CVE-2026-92183

CVE-2026-92183 is a stack-based buffer overflow in GIMP that can be leveraged for remote code execution . The flaw resides in the parsing of APNG files , where user-supplied data is copied to a stack-based buffer without proper validation of its length. A remote attacker can exploit this by convi...

CVE-2026-84579

CVE-2026-84579 is one of two Gatekeeper bypass CVEs awarded, as confirmed by a PT Security advisory (PT-2026-93360). The CVE entry remains in reserved status in the initial document, meaning the full technical description, affected versions, and root cause details have not yet been publicly publi...