CVE-2026-50277

dd-trace-cpp (Datadog's C++ distributed tracing library) prior to 2.1.0 parses incoming W3C baggage headers on the extraction path without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES limits, even though those limits are applied during injection. A remote unauthenticated att...

CVE-2026-54501

Browsertrix , a browser-based web archiving crawling service by Webrecorder, suffers from an arbitrary command injection due to improper sanitization of Git URLs supplied as Custom Behaviors via the /api/orgs/*/crawlconfigs/validate/custom-behavior endpoint. Affected versions are 1.15.0 through 1...

CVE-2026-54237

Wavelog is web-based amateur radio logging software. Versions 1.8 through 2.4.2 leave /install/ajax.php and /install/includes/interface_assets/triggers.php accessible after installation without an installation lock or permission check. Unsanitized input reaches write_config() and write_configfile...

CVE-2026-45140

Chamilo LMS (open-source learning management system) versions prior to 2.0.1 are vulnerable to unauthenticated remote code execution via the CStudio upload flow . An attacker can execute arbitrary code on the server without prior authentication, resulting in full compromise of confidentiality, in...

CVE-2026-45143

Chamilo LMS versions 2.0.0 through at least 2.1.0 contain a stored XSS in the private messaging feature. The Message.content field is stored without server-side sanitization and rendered as HTML via v-html in MessageShow.vue and view_message.html.twig. An authenticated low-privilege user (e.g., a...

CVE-2026-54460

OpenReception appointment booking software (prior to 1.1.1 ) is vulnerable to unauthenticated account takeover via the POST /api/auth/passkeys endpoint. The endpoint accepts an attacker-supplied userId and passkey without an authenticated session, fails to call WebAuthnService.verifyRegistration,...

CVE-2026-50022

Metacat , a data repository software, is affected by an unintended proxy vulnerability in its MetacatSolrIndex.query component prior to version 3.4.2 . The component forwards a client-controlled qt parameter through Apache SolrJ to a privileged Solr backend. An unauthenticated client can select t...

CVE-2026-50275

Datadog PHP Tracer prior to 1.19.2 contains a denial-of-service vulnerability in ddtrace_deserialize_baggage (ext/distributed_tracing_headers.c). The function parses incoming W3C baggage HTTP headers without enforcing DD_TRACE_BAGGAGE_MAX_ITEMS or DD_TRACE_BAGGAGE_MAX_BYTES, allowing a remote una...

CVE-2026-54918

NetBox Device Type Library is a community-sourced collection of device type definitions for import into NetBox. In affected revisions, the NETBOX_DT_LIBRARY_URL constant in tests/test_configuration.py is a free-form tracked value that an unauthenticated pull-request author can modify before the C...

CVE-2026-54916

NetBox Device Type Library (a community-sourced collection of device type definitions for import into NetBox) is affected by a module-shadowing vulnerability (CVSS 8.8 HIGH). The absence of tests/__init__.py combined with the lack of --import-mode=importlib causes pytest's prepend import mode to ...

CVE-2026-54752

NetBox Device Type Library is a community-sourced collection of device type definitions for import into NetBox. The vulnerability resides in the read_pickle_data function within tests/pickle_operations.py, which uses pickle.load to deserialize pull-request-controlled tracked pickle cache files. A...

CVE-2026-50125

MKP (Model Context Protocol server for Kubernetes, by StacklokLabs) prior to 0.4.1 exposes an unauthenticated get_resource tool on its default port 8080 that accepts attacker-controlled limitBytes and tailLines parameters. These values are parsed as unbounded int64 in pkg/k8s/subresource.go, and ...

CVE-2026-54594

CVE-2026-54594 affects the OmniBlocks monorepo in its GitHub Actions workflow .github/workflows/disc.yml . The workflow triggers on issues opened and issues edited events and invokes the createDiscussion GitHub GraphQL mutation whenever an issue is classified as off-topic, without recording that ...

CVE-2026-50285

Pomerium (identity and context-aware access proxy) versions prior to 0.32.8 are vulnerable to a pre-auth denial of service in the stateless authentication flow. The decodeQueryStringV2 function in pkg/hpke/url.go performs zstd decompression without an output-memory limit before sender identity is...

CVE-2026-54692

SAIL is a cross-platform image library that, prior to 1.0.0 , contains a heap out-of-bounds write in the XBM X10 decoder (sail_codec_load_frame_v8_xbm() in src/sail-codecs/xbm/xbm.c). When ceil(width/8) produces an odd row stride, the decoder writes two file-controlled bytes per literal into a bu...

CVE-2026-54627

SAIL is a cross-platform image library. In versions 0.9.10 and earlier , a mode/depth mismatch in the PSD decoder allows a crafted PSD to trigger a heap out-of-bounds write : psd_private_sail_pixel_format() resolves a one-channel Bitmap-mode PSD to a one-bit pixel format, while sail_codec_load_fr...

CVE-2026-54626

SAIL is a cross-platform image loading and saving library. In versions 0.9.10 and earlier , the TGA decoder's indexed-RLE path (image_type == 9) allocates a pixel buffer using a one-byte-per-pixel format, while the load function derives a two-to-four-byte per-pixel write width from an attacker-co...

CVE-2026-54618

Obsidian Web MCP , a remote MCP server for Obsidian vaults, contained an authentication bypass prior to version 0.2.0. The /oauth/authorize endpoint issued an authorization code without any login, consent, or session check, and /oauth/token allowed exchanging that code for the static VAULT_MCP_TO...

CVE-2026-54495

CVE-2026-54495 affects the OpenFeature Operator (version 0.9.2 and earlier). A tenant who can create a controller-owned workload can use the openfeature.dev/featureflagsource annotation with {NAMESPACE}/{NAME} syntax to reference a FeatureFlagSource or InProcessConfiguration in another namespace....

CVE-2026-54716

Valhalla (open source routing engine for OpenStreetMap data) versions 3.7.0 and earlier are vulnerable to a denial-of-service via the /sources_to_targets endpoint. A single unauthenticated POST request containing an exclude_polygons ring formed by three collinear points (zero-area geometry) trigg...