CVE-2026-93339

Metaphor Creations Ditty (WordPress plugin ditty-news-ticker) before 3.1.70 contains a stored XSS vulnerability in the ditty_layout_render_tag_wrapper() function. The function inserts caller-supplied wrapper attribute values directly as HTML element names without allowlist validation , bypassing ...

CVE-2026-52743

GoCD (a continuous delivery server) prior to version 26.1.0 contains an authorization bypass in its internal /jobStatus.json API. The endpoint fails to validate that a requested server-assigned job ID actually belongs to the pipeline and stage named in the request. An authenticated user can guess...

CVE-2026-55074

CVE-2026-55074 affects the Ansible FreeBSD Jail Connection Plugin (jailexec) through version 1.3.0 . The put_file function resolved transfer destinations to paths on the jail host and executed mkdir -p and mv as root on the host , rather than inside the jail. Because these commands follow symboli...

CVE-2026-55567

BleachBit prior to version 6.0.1 contains a local privilege escalation vulnerability in its privileged Windows cleaning process. The root cause is a failure to lock and validate a target's parent directory before deletion , allowing a local unprivileged user to replace that directory with a Windo...

CVE-2026-61629

nginx-ignition (a user interface for the nginx web server) versions 2.29.0 through 2.40.0 are vulnerable to a CPU amplification denial-of-service via the Accept-Language HTTP header. The gin i18n middleware calls golang.org/x/text/language.ParseAcceptLanguage on the raw header without size or sha...

CVE-2026-94184

A stack-based buffer overflow was identified in fetchmail when built with NTLM support. A malicious or compromised mail server advertising NTLM authentication can send a crafted Type 2 challenge that causes fetchmail to write past a fixed stack buffer while constructing the NTLM authenticate resp...

CVE-2026-61630

nginx ignition (a web user interface for nginx) in versions 2.33.0 through 2.35.0 allows any user who has enabled OTP 2FA to have their TOTP token reused during the standard 30-second validity window. The issue is fixed in version 2.35.1 . The CVSS 3.1 score is 4.2 (MEDIUM) , reflecting high atta...

CVE-2026-55071

MCP-for-Stata (stata-mcp), a Python MCP server for integrating Stata into AI agent loops, contains a command injection in its ado_package_install tool. The package argument is interpolated into an f-string in SSC_Install.install() with no sanitization, allowing newline-delimited payloads to injec...

CVE-2026-54584

mport , the MidnightBSD Package Manager, prior to version 2.7.8 , used the TMPDIR environment variable when extracting package metafiles, including in privileged (root, setuid/setgid) contexts. An attacker able to control the environment for a privileged mport invocation could redirect temporary ...

CVE-2026-80110

pki-core (Dogtag PKI) contains a flaw in its v2 REST ACL filter that resolves colliding literal and wildcard ACL keys using lexicographic string comparison rather than specificity. This causes a wildcard-mapped permission to override a more specific literal-mapped permission. In the CA's profile-...

CVE-2026-75939

CVE-2026-75939 affects openshift/oc-mirror , where the PGP release image signature verification incorrectly checks for signature errors before the entire signed body is consumed. This ordering flaw allows a remote attacker who intercepts or manipulates traffic to the signature endpoint to craft a...

CVE-2026-94404

MISP (Malware Information Sharing Platform) versions prior to 2.5.47 are affected by a CSRF vulnerability in its attribute modification function. The function did not properly enforce MISP's usual protection against forged requests, allowing an attacker to craft a malicious webpage that silently ...

CVE-2026-88807

libXrender (X.Org) versions before 0.9.13 are affected by a heap-based buffer overflow in the RenderQueryPictFormats reply handler. A malicious X server can exploit this to inject code into attached X clients. The vulnerability was assigned a CVSS 4.0 score of 8.9 (HIGH) , with active user intera...

CVE-2026-94387

Aureus ERP before version 1.6.0 is affected by a stored cross-site scripting (XSS) vulnerability in the Chatter field-change log component. The root cause is that old_value and new_value entries are rendered without proper escaping in the Filament blade template. Any user permitted to edit tracke...

CVE-2025-71421

UVdesk core-framework versions before 1.1.7 contain an improper privilege management vulnerability in the editAgent endpoint. An agent with existing agent-management privilege can submit their own account identifier with the role parameter set to ROLE_ADMIN, escalating their own role to administr...

CVE-2025-71420

UVdesk core-framework before 1.1.7 contains an authorization bypass in the saved reply endpoint. Agents holding the ROLE_AGENT permission can enumerate saved reply identifiers and read reply content restricted to other support groups or teams, resulting in a low confidentiality impact (CVSS 3.1 b...

CVE-2025-71419

UVdesk core-framework versions before 1.1.7 are affected by a stored cross-site scripting vulnerability in the SwiftMailer configuration identifier parameter of the createMailerConfiguration action. An attacker with the ROLE_AGENT privilege can inject a malicious script into the identifier field;...

CVE-2026-88806

libX11 versions before 1.8.14 are vulnerable to a heap-based buffer overflow in the handling of the XkbGetMap reply, specifically overflowing the key_sym_map buffer. A malicious X server can trigger this, leading to potential compromise of confidentiality, integrity, and availability as rated by ...

CVE-2026-94401

MISP versions below 2.5.47 contain an arbitrary local file read and SSRF vulnerability in the XML export/import upload functionality. The root cause is insufficient validation: MISP failed to verify that the uploaded content was actually XML, allowing an authenticated user with modify permissions...

CVE-2026-94394

CVE-2026-94394 affects the MISP threat intelligence platform, specifically the ObjectReferencesController . When a regular user adds a reference between objects or attributes, MISP verifies access to the parent event but does not always enforce granular sharing group or distribution-level restric...