CVE-2026-6390

CVE-2026-6390 affects GNU nano. The issue is a format string vulnerability in multi-buffer error handling: when opening multiple files at startup, a filename containing printf format specifiers can be reinterpreted, potentially enabling stack information disclosure, a crash (DoS), or arbitrary me...

CVE-2026-15074

The CVE-2026-15074 issue affects @fastify/static up to and including version 10.1.0, which fails to reject dot-dot path segments in request pathnames before file resolution. This bypasses the earlier fix for CVE-2026-6414 (encoded slashes only) because the underlying send library normalizes dot s...

CVE-2026-7120

The CVE-2026-7120 issue affects @fastify/static (versions up to and including 10.1.1). The root cause is that allowedPath is evaluated before normalizing dot segments and duplicate separators in the request pathname, allowing an unauthenticated attacker to bypass path-based filtering by using equ...

CVE-2026-21723

CVE-2026-21723 affects Grafana, specifically the alertmanager templates test endpoint at /api/alertmanager/grafana/config/api/v1/templates/test. The endpoint can execute templates with no memory limits, and mass execution in a short time can cause out-of-memory (OOM) and crash the Grafana service...

CVE-2026-16653

CVE-2026-16653 concerns boazsegev facil.io up to version 0.7.58. The vulnerability affects the Public Folder Handler, specifically the http_sendfile2 function in lib/facil/http/http.c, where manipulation allows path traversal. Remote exploitation is possible and the exploit has been released publ...

CVE-2026-29988

Technical details are not publicly available in the provided documents for CVE-2026-29988; monitor for updates.

CVE-2026-52687

Technical details are not publicly available in the provided documents; monitor for updates.

CVE-2026-39155

Knot DNS before 3.4.10 and 3.5.x before 3.5.4 contain a vulnerability in mod-onlinesign where the next NSEC owner name can be computed incorrectly, creating an overly broad authenticated denial interval. This enables downstream validating resolvers using aggressive negative caching to synthesize ...

CVE-2026-91204

Technical details for CVE-2026-91204 are not publicly available in the provided documents. Monitor for updates.

CVE-2026-38764

Protegent 360 v2.0.0.4 from Unistal Systems Pvt. Ltd. contains a local privilege escalation vulnerability in the kernel driver pgsecdl.sys (CVE-2026-38764). The issue enables a low-privilege local attacker to escalate to SYSTEM, with a CVSS v3.1 base score of 7.8 (High): Local, Low privileges req...

CVE-2026-52439

Affected software: xiandafu beetl 3.20.2. The vulnerability arises from the type.new function combined with the property reflection mechanism, allowing a remote attacker to execute arbitrary code. The impact is remote code execution with high severity (as per CVSS 3.1: AV:N/AC:L/PR:N/UI:N/S:U/C:H...

CVE-2026-16632

CVE-2026-16632 affects boazsegev facil.io up to 0.7.4, specifically the WebSocket Frame Parser component. The vulnerability is in websocket_on_protocol_error (library file lib/facil/http/parsers/websocket_parser.h) where manipulation of the on_message argument leads to improper input validation. ...

CVE-2026-16631

The CVE-2026-16631 entry concerns publint up to version 0.1.4 where the pack.js file in the package-manager Command Handler uses child_process.exec, enabling os command injection. Local attack required; exploit is public. A patch identified as adf2d9a09945fc98c85a2520a89f441d78b2dbd8 exists and s...

CVE-2026-10050

Summary: The GitHub advisory for Eclipse Jetty Digest Authentication documents a root-cause in DigestAuthentication.apply() that uses ISO-8859-1 to compute H(A1), H(A2), and H(A3). Characters outside U+00FF are silently replaced with 0x3F, causing identical MD5-based Digest responses for distinct...

CVE-2026-61246

CVE-2026-61246 affects Oracle Platform Security for Java (Oracle Fusion Middleware) - Centralized Thirdparty Jars. The vulnerability is exploitable over HTTP by a low-privileged attacker with network access and can lead to takeover of Oracle Platform Security for Java. Affected versions are 12.2....

CVE-2026-60455

The CVE-2026-60455 affects Oracle Platform Security for Java (Oracle Fusion Middleware), specifically the Centralized Thirdparty Jars component. Affected supported versions are 12.2.1.4.0 and 14.1.2.0.0. The vulnerability is exploitable by a low-privilege attacker with network access via HTTP, po...

CVE-2026-60439

CVE-2026-60439 affects the Oracle Platform Security for Java component “Centralized Thirdparty Jars” in Oracle Fusion Middleware. Affected versions are 12.2.1.4.0 and 14.1.2.0.0. The description specifies that a low-privilege, network-reachable attacker (via HTTP) can compromise Oracle Platform S...

CVE-2026-60372

CVE-2026-60372 concerns the Oracle Platform Security for Java component of Oracle Fusion Middleware, specifically the Centralized Thirdparty Jars. Affects supported versions 12.2.1.4.0 and 14.1.2.0.0. The vulnerability allows an unauthenticated attacker with network access over HTTP to compromise...

CVE-2026-60373

The CVE-2026-60373 entry concerns Oracle Platform Security for Java (Oracle Fusion Middleware) with the affected component Centralized Thirdparty Jars. Affected versions are 12.2.1.4.0 and 14.1.2.0.0. The vulnerability allows a low-privileged attacker who can reach the system over HTTP to comprom...

CVE-2026-60371

CVE-2026-60371 affects Oracle Platform Security for Java (Fusion Middleware), specifically the Centralized Thirdparty Jars component. Affected versions are 12.2.1.4.0 and 14.1.2.0.0. The issue is described as difficult to exploit, requiring low privileges and access to the hardware’s physical com...