CVE-2026-77609

Semantic MediaWiki (open-source MediaWiki extension) prior to version 7.2.0 contains an open redirect in Special:URIResolver. The page resolves its user-controlled subpage to a MediaWiki title and issues an HTTP 303 redirect to $title->getFullURL() without validating the resolved target , allo...

CVE-2026-63406

AnyCable versions prior to 1.6.15 contain a confidentiality issue in its telemetry subsystem. The file telemetry/config.go embeds a hardcoded public authToken ("secret") used to authenticate to telemetry.anycable.io, while clusterFingerprint() in telemetry/telemetry.go incorporates raw CLI argume...

CVE-2026-77607

Semantic MediaWiki , a free open-source MediaWiki extension, had a reflected XSS vulnerability in versions prior to 7.2.0 . The sep parameter in the Special:Ask table renderer was inserted verbatim into HTML cell joins, allowing an attacker to inject arbitrary HTML through the separator value. Pe...

CVE-2026-63405

AnyCable is a realtime server supporting any backend. Prior to 1.6.15 , its Pusher-compatible REST API (in pusher/http.go) includes the caller-supplied body_md5 value in the HMAC signature but never computes or verifies the MD5 of the actual received body. Because there is also no auth_timestamp ...

CVE-2026-46655

The Viosock driver (viosock.sys) in virtio-win (versions mm210 through mm319) is vulnerable to a local privilege escalation in Windows guests running QEMU or KVM. A low-privilege process can submit an IOCTL_SELECT request with crafted VIRTIO_VSOCK_SELECT.Fdss[*].fd_count values that cause an inte...

CVE-2026-77239

WACRM (a self-hostable CRM template for WhatsApp) versions 0.7.0 and earlier have an authorization flaw in flow and automation write routes. The routes authenticate account viewers but fail to enforce the agent role before invoking a service-role database client that bypasses row-level security. ...

CVE-2026-93559

A missing authentication vulnerability affects Forget-C Jellyfish AI Short Drama Studio (versions 0.1.0-alpha through 0.3.2) in an unknown function of backend/app/dependencies.py, a FastAPI component. An unauthenticated remote attacker can exploit this without user interaction, leading to low imp...

CVE-2026-91142

Cockpit contains an integer overflow in the do_lastlog() function's offset calculation for lastlog entries, specifically on ILP32 (32-bit) builds. A low-privileged authenticated user with a specially provisioned large UID can cause the computed offset to wrap around, enabling unauthorized reads a...

CVE-2026-91147

A denial-of-service flaw was identified in cockpit-ws , the web service component of Cockpit . When WebService.UrlRoot is configured, a remote, unauthenticated attacker can cause cockpit-ws to terminate unexpectedly by sending a request to the exact URL-root prefix without a trailing slash . The ...

CVE-2026-91149

A flaw in Cockpit allows an unauthenticated remote attacker to trigger a denial of service by initiating and sustaining numerous simultaneous connections to the cockpit-tls service. The service creates an unbounded number of detached threads , exhausting system resources such as memory and file d...

CVE-2026-77608

Semantic MediaWiki , a free open-source extension to MediaWiki, is affected by a reflected cross-site scripting (XSS) vulnerability in the Special:SearchByProperty page. Prior to version 7.2.0 , the value parameter was reflected into rendered output and error messaging paths without sufficient ou...

CVE-2026-77240

WACRM is a self-hostable CRM template for WhatsApp. In version 0.7.0 and earlier , two database-layer authorization bypasses exist in the Supabase backend. First, the profiles_update row-level security policy in 017_account_sharing.sql allows an authenticated user to modify their own account_role...

CVE-2026-77606

Semantic MediaWiki , a free open-source extension to MediaWiki, is affected by a reflected XSS vulnerability in Special:Ask when the headers=plain option is used. Table header text was emitted into elements via a raw HTML path , allowing user-controlled mainlabel content to become executable HTM...

CVE-2026-77301

adm-zip is a Node.js JavaScript library for creating and extracting ZIP archives. Prior to version 0.6.1 , the getData() function in zipEntry.js trusts an entry's central-directory uncompressed size and allocates output memory before validating that value against the actual compressed data and de...

CVE-2026-93579

A vulnerability in Netty's netty-codec-http2 module allows a remote attacker to inject prohibited characters—NUL, Line Feed, and Carriage Return —into HTTP/2 header field values due to insufficient default validation. When such values cross an HTTP/2 to HTTP/1.1 translation boundary , the injecte...

CVE-2026-77339

Process Compose (a scheduler and orchestrator for non-containerized applications) had a vulnerability in its MCP SSE listener (src/mcp/server.go) prior to version 1.120.0 . The listener accepted browser-origin requests to /sse and the returned message endpoint without validating the Host or Origi...

CVE-2026-58197

ToolHive is a utility for deploying and managing Model Context Protocol (MCP) servers. Prior to CLI 0.30.1 and Studio 0.38.0 , locally run MCP server containers use the default network permission profile without network isolation, permitting access to host.docker.internal while the ToolHive API a...

CVE-2026-61795

Capsule , a multi-tenancy and policy-based framework for Kubernetes, is affected in versions 0.13.0 through 0.13.7 . The root cause lies in hostnameRegexHandler.OnUpdate (internal/webhook/tenant/validation/hostname_regex.go), which reverses the new and old Tenant parameters , causing the webhook ...

CVE-2026-93534

spatie Scotty (versions up to 1.4.2 ) is affected by a vulnerability in the SelfUpdater::update function within app/Updater/SelfUpdater.php, part of the Self Update Handler component. The root cause is that the self-update process downloads code without an integrity check , allowing an attacker t...

CVE-2026-61672

Capsule is a multi-tenancy and policy-based framework for Kubernetes. Prior to 0.13.7 , the ForbiddenListSpec.ExactMatch function in pkg/api/forbidden_list.go sorts denied metadata keys case-insensitively but then calls sort.SearchStrings, which assumes byte-order sorting. When an administrator's...