PatchBrief

Grav: Unauthenticated denial of service via unbounded image derivative dimensions

Fri, 14 Aug 2026 00:00:00 +0000

Grav: Unauthenticated denial of service via unbounded image derivative dimensions

Authorizer: Zero-click account takeover via OAuth identity linking to unverified email accounts

Fri, 14 Aug 2026 00:00:00 +0000

Authorizer: Zero-click account takeover via OAuth identity linking to unverified email accounts

Lima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket

Fri, 14 Aug 2026 00:00:00 +0000

Lima: An arbitrary user in a QEMU VM could gain the root privilege in the VM via the guest agent socket

OpenAM Insecure SSO Cookie Initialization

Fri, 14 Aug 2026 00:00:00 +0000

OpenAM Insecure SSO Cookie Initialization

mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"

Fri, 14 Aug 2026 00:00:00 +0000

mchange-commons-java contains elements susceptible to abuse via JNDI injection and "deserialization gadgets"

MindsDB Minds Platform version 26.1.0 and earlier — CVE-2026-73678 (Critical)

Fri, 14 Aug 2026 00:00:00 +0000

MindsDB Minds Platform version 26.1.0 and earlier contains an unauthenticated remote code execution vulnerability that allows unauthenticated attackers to execute arbitrary OS commands by submitting crafted prompts to the unprotected POST /api/v1/responses/ endpoint, which reaches the Anton agent's scratchpad tool that calls exec() on attacker-influenced Python source without sandboxing. Attackers can first configure their own LLM API key through the unauthenticated PUT /api/v1/settings/ endpoint, then POST a prompt directing the agent to invoke the scratchpad tool with arbitrary Python code,

Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

Fri, 14 Aug 2026 00:00:00 +0000

Budibase: SSRF in Automation Steps - Webhook, Zapier, N8N, Slack, Discord Bypass IP Blacklist

Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

Fri, 14 Aug 2026 00:00:00 +0000

Token Optimizer MCP: OS command injection in smart_user via username in get-user-info

Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

Thu, 13 Aug 2026 00:00:00 +0000

Pimcore: ClassDefinition UID regex missing end anchor allows SQL injection via Block.php unquoted table name

Fluent Forms Pro 6.2.7 — CVE-2026-73532 (Critical)

Thu, 13 Aug 2026 00:00:00 +0000

Fluent Forms Pro 6.2.7 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (libs/class-license-sync.php), loaded via a require_once directive added to fluentformpro.php, that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal.

Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-...

Thu, 13 Aug 2026 00:00:00 +0000

Argo Workflows: ArtifactGC.PodSpecPatch bypasses Strict/Secure template reference allow-list (Incomplete fix for CVE-2026-31892)

Ninja Tables Pro 5.2.11 — CVE-2026-73533 (Critical)

Thu, 13 Aug 2026 00:00:00 +0000

Ninja Tables Pro 5.2.11 contains an embedded malicious code vulnerability introduced via a tampered plugin build served through a decommissioned update server. The tampered build introduced a rogue PHP file (app/Library/updater/NinjaTableDataSync.php) that established a backdoor REST API endpoint, dropped persistent PHP files in mu-plugins and uploads directories, installed a passwordless administrator account, and registered scheduled tasks that survived plugin removal.

Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS

Thu, 13 Aug 2026 00:00:00 +0000

Trigger.dev: Prototype pollution via run metadata operations → process-wide cross-tenant DoS

nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences

Thu, 13 Aug 2026 00:00:00 +0000

nltk: Arbitrary File Read via Path Traversal in nltk.data.load() through Percent-Encoded Sequences

atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read

Thu, 13 Aug 2026 00:00:00 +0000

atomic-agents-stack: Dashboard HTTP server path traversal allows arbitrary file read

Winter: Stored XSS through Brand Settings custom styles

Wed, 12 Aug 2026 00:00:00 +0000

Winter: Stored XSS through Brand Settings custom styles

Winter: Stored XSS through Editor Settings custom styles

Wed, 12 Aug 2026 00:00:00 +0000

Winter: Stored XSS through Editor Settings custom styles

Winter: Authenticated backend users can bypass Users controller permission checks

Wed, 12 Aug 2026 00:00:00 +0000

Winter: Authenticated backend users can bypass Users controller permission checks

SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access

Wed, 12 Aug 2026 00:00:00 +0000

SeaweedFS: Path traversal in the S3 and Iceberg REST gateways allows cross-bucket access

Ibm I — CVE-2026-16860 (Critical)

Wed, 12 Aug 2026 00:00:00 +0000

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to an uncontrolled search path element.

Ibm I — CVE-2026-17276 (Critical)

Wed, 12 Aug 2026 00:00:00 +0000

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to escalate privileges due to improper authorization in the handling of high-authority threads.

SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames

Wed, 12 Aug 2026 00:00:00 +0000

SSH.NET: ScpClient Recursive Download Allows Arbitrary File Write via Server-Controlled SCP Filenames

SIPSorcery vulnerable to Denial of Service via out-of-bounds read in SCTP SACK chunk parsing

Wed, 12 Aug 2026 00:00:00 +0000

SIPSorcery vulnerable to Denial of Service via out-of-bounds read in SCTP SACK chunk parsing

SIPSorcery: Malformed UDP datagram crashes TurnServer receive loop with no restart, disabling TURN UDP relay for all ...

Wed, 12 Aug 2026 00:00:00 +0000

SIPSorcery: Malformed UDP datagram crashes TurnServer receive loop with no restart, disabling TURN UDP relay for all clients (DoS)

compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0

Wed, 12 Aug 2026 00:00:00 +0000

compliance-trestle has an URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0

MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`

Wed, 12 Aug 2026 00:00:00 +0000

MCP-for-Stata: Stata Command Injection via Unsanitized `package` in `ado_package_install`

Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)

Wed, 12 Aug 2026 00:00:00 +0000

Ansible FreeBSD Jail Connection Plugin: Jail escape via symlink following in put_file (host-side root mv)

nimiq-blockchain: Validity store off by one error

Wed, 12 Aug 2026 00:00:00 +0000

nimiq-blockchain: Validity store off by one error

Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) Heap Inspection Vuln...

Tue, 11 Aug 2026 00:00:00 +0000

Cisco Secure Firewall Adaptive Security Appliance (ASA) and Secure Firewall Threat Defense (FTD) contain a heap inspection vulnerability that could allow an unauthenticated, remote attacker to cause the device to reload unexpectedly, resulting in a denial of service (DoS) condition.

SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle

Tue, 11 Aug 2026 00:00:00 +0000

SeaweedFS: Unauthenticated SSRF with response read-back via VolumeServer.FetchAndWriteNeedle

Metabase SQL Injection Vulnerability

Tue, 11 Aug 2026 00:00:00 +0000

Metabase contains a SQL Injection vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data.

Windows Active Directory Domain Services Remote Code Execution Vulnerability

Tue, 11 Aug 2026 00:00:00 +0000

Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an unauthorized attacker to execute code over a network. Published in August 2026 Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Unlikely.

Visual Studio Code Security Feature Bypass Vulnerability

Tue, 11 Aug 2026 00:00:00 +0000

Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally. Published in August 2026 Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely.

Visual Studio Code Remote Code Execution Vulnerability

Tue, 11 Aug 2026 00:00:00 +0000

Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network. Published in August 2026 Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely.

Microsoft High Performance Computing (HPC) Pack Remote Code Execution Vulnerability

Tue, 11 Aug 2026 00:00:00 +0000

Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized attacker to execute code over a network. Published in August 2026 Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely.

Windows TCP/IP Denial of Service Vulnerability

Tue, 11 Aug 2026 00:00:00 +0000

Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over a network. Published in August 2026 Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely.

Microsoft High Performance Computing (HPC) Pack Elevation of Privilege Vulnerability

Tue, 11 Aug 2026 00:00:00 +0000

Execution with unnecessary privileges in Microsoft High Performance Computing (HPC) Pack allows an authorized attacker to elevate privileges over a network. Published in August 2026 Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely.

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Tue, 11 Aug 2026 00:00:00 +0000

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. Published in August 2026 Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely.

Windows Installer Elevation of Privilege Vulnerability

Tue, 11 Aug 2026 00:00:00 +0000

Incorrect authorization in Windows Installer allows an authorized attacker to elevate privileges locally. Published in August 2026 Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely.

Windows Kernel Elevation of Privilege Vulnerability

Tue, 11 Aug 2026 00:00:00 +0000

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally. Published in August 2026 Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely.

Windows MIDI Service Module Elevation of Privileges Vulnerability

Tue, 11 Aug 2026 00:00:00 +0000

Heap-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally. Published in August 2026 Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely.

Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability

Tue, 11 Aug 2026 00:00:00 +0000

Integer underflow (wrap or wraparound) in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally. Published in August 2026 Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely.

Windows Win32k Elevation of Privilege Vulnerability

Tue, 11 Aug 2026 00:00:00 +0000

Heap-based buffer overflow in Windows Win32K allows an authorized attacker to elevate privileges locally. Published in August 2026 Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely.

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Tue, 11 Aug 2026 00:00:00 +0000

Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. Published in August 2026 Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely.

Microsoft SharePoint Server Elevation of Privilege Vulnerability

Tue, 11 Aug 2026 00:00:00 +0000

Improper authentication in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. Published in August 2026 Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely.

Microsoft 365 Admin Center Elevation of Privilege Vulnerability

Tue, 11 Aug 2026 00:00:00 +0000

Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker to elevate privileges over a network. Published in August 2026 Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:N/A.

Microsoft Planetary Computer Pro Elevation of Privilege Vulnerability

Tue, 11 Aug 2026 00:00:00 +0000

Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network. Published in August 2026 Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:N/A.

Microsoft SharePoint Server Remote Code Execution Vulnerability

Tue, 11 Aug 2026 00:00:00 +0000

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. Published in August 2026 Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely.

Microsoft SharePoint Server Remote Code Execution Vulnerability

Tue, 11 Aug 2026 00:00:00 +0000

Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network. Published in August 2026 Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation More Likely.

Microsoft Teams Remote Code Execution Vulnerability

Tue, 11 Aug 2026 00:00:00 +0000

Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Teams for Android allows an unauthorized attacker to execute code over a network. Published in August 2026 Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely.

Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

Tue, 11 Aug 2026 00:00:00 +0000

Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.

Microsoft Security Advisory CVE-2026-62871 – .NET Elevation of Privilege Vulnerability

Tue, 11 Aug 2026 00:00:00 +0000

Microsoft Security Advisory CVE-2026-62871 – .NET Elevation of Privilege Vulnerability

Microsoft Security Advisory CVE-2026-62886 – .NET Elevation of Privilege Vulnerability

Tue, 11 Aug 2026 00:00:00 +0000

Microsoft Security Advisory CVE-2026-62886 – .NET Elevation of Privilege Vulnerability

Microsoft Security Advisory CVE-2026-62897 – .NET Remote Code Execution Vulnerability

Tue, 11 Aug 2026 00:00:00 +0000

Microsoft Security Advisory CVE-2026-62897 – .NET Remote Code Execution Vulnerability

Microsoft Security Advisory CVE-2026-62898 – .NET Information Disclosure Vulnerability

Tue, 11 Aug 2026 00:00:00 +0000

Microsoft Security Advisory CVE-2026-62898 – .NET Information Disclosure Vulnerability

Microsoft Security Advisory CVE-2026-62901 – .NET Denial of Service Vulnerability

Tue, 11 Aug 2026 00:00:00 +0000

Microsoft Security Advisory CVE-2026-62901 – .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-70354 – .NET Core Remote Code Execution Vulnerability

Tue, 11 Aug 2026 00:00:00 +0000

Microsoft Security Advisory CVE-2026-70354 – .NET Core Remote Code Execution Vulnerability

VU#431093: TCG TPM 2.0 reference code found vulnerable to information leakage and timing side-channel attacks

Tue, 11 Aug 2026 00:00:00 +0000

Overview Two vulnerabilities have been identified in the Trusted Platform Module (TPM) 2.0 reference implementation: CVE-2026-6726 – Information leakage via falsified TPM keys. CVE-2026-6727 – A timing side-channel vulnerability in RSA OAEP decryption. An attacker with privileged access to a TPM command interface may be able to exploit these vulnerabilities by sending specially crafted TPM commands. Successful exploitation could allow the attacker to decrypt ciphertexts encrypted to affected TPM-managed RSA keys, including the RSA Endorsement Key (EK), or obtain credentials for falsified TPM keys, enabling forged TPM 2.0 attestations. These vulnerabilities are also documented by the Trusted Computing Group (TCG) in advisories - TCGVRT010 and TCGVRT0011 : Description Trusted Platform Module (TPM) technology provides hardware-backed... Related CVEs: CVE-2026-6726, CVE-2026-6727.

VU#614868: Opencart ecommerce platform contains directory traversal vulnerability

Mon, 10 Aug 2026 00:00:00 +0000

Overview The OpenCart v4.2.0.0 extension installer contains a directory traversal vulnerability. The extension installation process extracts uploaded .zip files then uses the zip entry filenames as filesystem paths, without validating that the resolved path stays inside the intended directory. This vulnerability is tracked as CVE-2026-18412. Description OpenCart is a free, open‑source e‑commerce solution designed to help businesses build and manage online stores. OpenCart extensions are uploaded as zip files with .ocmod.zip extensions. Upon installation, the OpenCart v4.2.0.0 extension installer extracts these zip files, but does not validate that the extracted paths stay inside the intended extraction directory. An attacker can craft a malicious extension containing file path traversal sequences, such as ../ . With this vulnerability... Related CVEs: CVE-2026-18412.

MSI Radix AXE6600 router firmware version v781521 — CVE-2026-71984 (Critical)

Sun, 09 Aug 2026 00:00:00 +0000

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the urlfilter function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit the urlfilter function to inject malicious commands and obtain root privileges on the underlying system.

MSI Radix AXE6600 router firmware version v781521 — CVE-2026-71985 (Critical)

Sun, 09 Aug 2026 00:00:00 +0000

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the accesscontrol function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the accesscontrol function to execute malicious commands and obtain root privileges on the underlying system.

MSI Radix AXE6600 router firmware version v781521 — CVE-2026-71986 (Critical)

Sun, 09 Aug 2026 00:00:00 +0000

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the dmz function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the dmz function to execute malicious commands and obtain root privileges on the underlying system.

MSI Radix AXE6600 router firmware version v781521 — CVE-2026-71987 (Critical)

Sun, 09 Aug 2026 00:00:00 +0000

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the alg function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the alg function to execute malicious commands and obtain root privileges on the underlying system.

MSI Radix AXE6600 router firmware version v781521 — CVE-2026-71988 (Critical)

Sun, 09 Aug 2026 00:00:00 +0000

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the portFw function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the alg function to execute malicious commands and obtain root privileges on the underlying system.

MSI Radix AXE6600 router firmware version v781521 — CVE-2026-71989 (Critical)

Sun, 09 Aug 2026 00:00:00 +0000

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the porTrigger function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the alg function to execute malicious commands and obtain root privileges on the underlying system.

MSI Radix AXE6600 router firmware version v781521 — CVE-2026-71990 (Critical)

Sun, 09 Aug 2026 00:00:00 +0000

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for SSH configuration that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the SSH configuration interface to inject malicious commands and obtain root privileges on the underlying system.

MSI Radix AXE6600 router firmware version v781521 — CVE-2026-71991 (Critical)

Sun, 09 Aug 2026 00:00:00 +0000

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the TelnetSSH function used for Telnet configuration that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit this vulnerability through the Telnet configuration interface to inject malicious commands and obtain root privileges on the underlying system.

MSI Radix AXE6600 router firmware version v781521 — CVE-2026-71992 (Critical)

Sun, 09 Aug 2026 00:00:00 +0000

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the macfilter function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit the macfilter function to inject malicious commands and obtain root privileges on the underlying system.

MSI Radix AXE6600 router firmware version v781521 — CVE-2026-71993 (Critical)

Sun, 09 Aug 2026 00:00:00 +0000

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the openvpn function that allows remote attackers to execute arbitrary commands on the affected device. Attackers can exploit the macfilter function to inject malicious commands and obtain root privileges on the underlying system.

D-Link DWR-M961 devices with hardware version C1 and firmware — CVE-2026-71944 (Critical)

Sat, 08 Aug 2026 00:00:00 +0000

D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formLtefotaUpgradeQuectel interface. A remote attacker can inject arbitrary malicious commands into the fota_url field, resulting in command execution with root privileges.

D-Link DWR-M961 devices with hardware version C1 and software — CVE-2026-71956 (Critical)

Sat, 08 Aug 2026 00:00:00 +0000

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command injection vulnerability in the app.cgi interface. A remote attacker can inject arbitrary malicious commands into the netDig.ping.dst field, resulting in command execution with root privileges.

D-Link DWR-M961 devices with hardware version C1 and software — CVE-2026-71957 (Critical)

Sat, 08 Aug 2026 00:00:00 +0000

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the app.cgi interface. A remote attacker can write an overly long string to the netAcc.addlist[].name field and execute arbitrary commands by crafting a specific payload, or cause the device to crash.

D-Link DWR-M961 devices with hardware version C1 and software — CVE-2026-71958 (Critical)

Sat, 08 Aug 2026 00:00:00 +0000

D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can write overly long strings to the test4, ssid2, and username fields and execute arbitrary commands by crafting a specific payload, or cause the device to crash.

MSI Radix AXE6600 router firmware version v781521 — CVE-2026-71983 (Critical)

Sat, 08 Aug 2026 00:00:00 +0000

MSI Radix AXE6600 router firmware version v781521 contains a command injection vulnerability in the wps.cgi interface that allows remote attackers to execute arbitrary commands by injecting malicious input through the pin2g, pin5g, or pin6g parameters. Attackers can exploit these unsanitized parameters to execute arbitrary commands on the affected device and obtain root privileges.

CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions

Fri, 07 Aug 2026 00:00:00 +0000

CodeIgniter: SQL injection in Query Builder deleteBatch() when used with where() conditions

CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames

Fri, 07 Aug 2026 00:00:00 +0000

CodeIgniter: Path traversal in UploadedFile::move() when using client-provided filenames

CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules

Fri, 07 Aug 2026 00:00:00 +0000

CodeIgniter: Uploaded file extension validation bypass in `is_image` and `mime_in` rules

Craft CMS: Passkey login accepts replayed WebAuthn assertions

Fri, 07 Aug 2026 00:00:00 +0000

Craft CMS: Passkey login accepts replayed WebAuthn assertions

Dell Openmanage Server Administrator — CVE-2026-56793 (Critical)

Fri, 07 Aug 2026 00:00:00 +0000

Dell OpenManage Server Administrator, versions prior to 11.1.0.2, contains an Improper Authentication vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, leading to Unauthorized access.

VU#987105: The nothings stb TrueType library, up to version 1.26, contains a heap buffer overflow vulnerability

Fri, 07 Aug 2026 00:00:00 +0000

Overview A heap buffer overflow vulnerability exists in the stb TrueType library created by nothings. Exploitation of this vulnerability can occur when handling malformed font data and may lead to both Denial of Service (DoS) and Information Disclosure. Description The nothings stb repository, versions 1.26 and earlier, contains a collection of single-file public domain and MIT-licensed libraries for C/C++ projects. CVE-2026-18497 A heap buffer overflow vulnerability exists in the stbtt_GetGlyphShape() function within the stb_truetype.h library when handling malformed TrueType Font (TTF) data. The issue occurs during glyph contour parsing. The function iterates based on the number of contour endpoints specified in endPtsOfContours , but does not validate that the points pointer remains within the bounds of the glyph data buffer. As a... Related CVEs: CVE-2026-18497.

go-git: Worktree operations may follow symlinks

Fri, 07 Aug 2026 00:00:00 +0000

go-git: Worktree operations may follow symlinks

jsii-diff: Command Injection via npm: package argument

Fri, 07 Aug 2026 00:00:00 +0000

jsii-diff: Command Injection via npm: package argument

crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

Fri, 07 Aug 2026 00:00:00 +0000

crypto-js: Insufficient Entropy in Cryptographic Secret Generation via Vulnerable CryptoJS Dependency Chain

Progress LoadMaster Command Injection Vulnerability

Fri, 07 Aug 2026 00:00:00 +0000

Progress LoadMaster contains a command injection vulnerability that allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command endpoints.

pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors

Fri, 07 Aug 2026 00:00:00 +0000

pymdown-extensions: exponential-backtracking ReDoS in caret, tilde, betterem, and magiclink inline processors

GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file o...

Fri, 07 Aug 2026 00:00:00 +0000

GitPython: Unguarded git read-tree option forwarding in IndexFile.from_tree/reset/merge_tree enables arbitrary file overwrite

GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks

Fri, 07 Aug 2026 00:00:00 +0000

GitPython: Unguarded git option forwarding in Repo.init enables arbitrary command execution via --template clone hooks

GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in G...

Fri, 07 Aug 2026 00:00:00 +0000

GitPython: Arbitrary Git Repository Creation Outside the Working Tree via Unvalidated .gitmodules Submodule Name in GitPython

GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshComma...

Fri, 07 Aug 2026 00:00:00 +0000

GitPython: git-config OPTION-name injection via =/#/whitespace bypasses name validator, enabling forged core.sshCommand/hooksPath (RCE)

GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables co...

Fri, 07 Aug 2026 00:00:00 +0000

GitPython: Unsafe git option guard bypass via split_single_char_options=False short-option token smuggling enables command execution

Statamic: Account takeover via OAuth email matching without email-verification check

Thu, 06 Aug 2026 00:00:00 +0000

Statamic: Account takeover via OAuth email matching without email-verification check

PHP_CodeSniffer gitblame report command injection via crafted filename

Thu, 06 Aug 2026 00:00:00 +0000

PHP_CodeSniffer gitblame report command injection via crafted filename

league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

Thu, 06 Aug 2026 00:00:00 +0000

league/commonmark: Quadratic-time denial of service when parsing crafted Markdown

Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

Thu, 06 Aug 2026 00:00:00 +0000

Craft CMS: Authenticated RCE via `condition.config` JSON cleanse bypass

Craft CMS: Authenticated RCE through Twig sandbox escape

Thu, 06 Aug 2026 00:00:00 +0000

Craft CMS: Authenticated RCE through Twig sandbox escape

league/commonmark: Denial of service via adjacent inline attribute blocks

Thu, 06 Aug 2026 00:00:00 +0000

league/commonmark: Denial of service via adjacent inline attribute blocks

league/commonmark: Denial of service via duplicate footnote definitions

Thu, 06 Aug 2026 00:00:00 +0000

league/commonmark: Denial of service via duplicate footnote definitions

league/commonmark: Denial of service via colliding heading slugs

Thu, 06 Aug 2026 00:00:00 +0000

league/commonmark: Denial of service via colliding heading slugs

Craft CMS: Arbitrary user password reset leading to administrator account takeover

Thu, 06 Aug 2026 00:00:00 +0000

Craft CMS: Arbitrary user password reset leading to administrator account takeover

VU#487613: Alinto SOGo v5.12.7 vulnerable to cross-site scripting via malformed ICS calendar invitations

Thu, 06 Aug 2026 00:00:00 +0000

Overview A cross-site scripting (XSS) vulnerability in Alinto SOGo v5.12.7 allows attackers to achieve remote code execution by embedding malicious SVG (Scalable Vector Graphics) objects in ICS (iCalendar) invitations. The vulnerability has been actively exploited in the wild, as confirmed by VirusTotal sightings. Description Alinto SOGo is an open-source webmail and groupware platform for email, calendars, contacts, and shared scheduling. It is primarily used by organizations seeking a self-hosted interface solution for existing mail infrastructure. CVE-2026-8496 The vulnerability exists in SOGo’s handling of ICS files, where the DESCRIPTION field is rendered without proper sanitization or Content Security Policy (CSP) enforcement. When a calendar invite contains an SVG payload, such as , with JavaScript event handlers, the browser... Related CVEs: CVE-2026-8496.

Dell Virtual Storage Integrator — CVE-2026-54489 (Critical)

Thu, 06 Aug 2026 00:00:00 +0000

Dell Virtual Storage Integrator for VMware vSphere Client, versions prior to 10.11.1.0, contain(s) a Sensitive Information Disclosure vulnerability. An unauthenticated remote attacker could potentially exploit this vulnerability, leading to information disclosure and session hijacking. This vulnerability is considered critical as it allows an unauthenticated attacker to obtain active session credentials and fully impersonate authenticated users, including administrators. Dell recommends customers to upgrade at the earliest opportunity.

Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware

Thu, 06 Aug 2026 00:00:00 +0000

Traefik: Authentication Bypass via Path Traversal in ReplacePathRegex Middleware

Traefik: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass

Thu, 06 Aug 2026 00:00:00 +0000

Traefik: Kubernetes Ingress NGINX RewriteTarget Path Traversal Allows Route-Level Authentication Bypass

Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

Thu, 06 Aug 2026 00:00:00 +0000

Traefik: Cross-user response poisoning via proxied CONNECT on Traefik's shared backend keep-alive pool

Traefik: Gateway API route identity collision allows cross-namespace backend hijacking

Thu, 06 Aug 2026 00:00:00 +0000

Traefik: Gateway API route identity collision allows cross-namespace backend hijacking

Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle

Thu, 06 Aug 2026 00:00:00 +0000

Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle Published in August 2026 Early Security Updates.

Application Insights Profiler Elevation of Privilege Vulnerability

Thu, 06 Aug 2026 00:00:00 +0000

Improper limitation of a pathname to a restricted directory ('path traversal') in Application Insights Profiler allows an authorized attacker to elevate privileges over a network. Published in August 2026 Early Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No.

Azure Active Directory Elevation of Privilege Vulnerability

Thu, 06 Aug 2026 00:00:00 +0000

Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to elevate privileges over a network. Published in August 2026 Early Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:N/A.

Azure Service Bus Remote Code Execution Vulnerability

Thu, 06 Aug 2026 00:00:00 +0000

Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a network. Published in August 2026 Early Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:N/A.

Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability

Thu, 06 Aug 2026 00:00:00 +0000

Missing authentication for critical function in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network. Published in August 2026 Early Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely.

Kata Containers: Config Path Annotation Arbitrary File Loading

Thu, 06 Aug 2026 00:00:00 +0000

Kata Containers: Config Path Annotation Arbitrary File Loading Published in August 2026 Early Security Updates.

Azure Logic Apps Information Disclosure Vulnerability

Thu, 06 Aug 2026 00:00:00 +0000

Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network. Published in August 2026 Early Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:N/A.

Azure SQL Database Elevation of Privilege Vulnerability

Thu, 06 Aug 2026 00:00:00 +0000

Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a network. Published in August 2026 Early Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:N/A.

Microsoft Entra Provisioning Service Elevation of Privilege Vulnerability

Thu, 06 Aug 2026 00:00:00 +0000

'.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate privileges over a network. Published in August 2026 Early Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:N/A.

Microsoft Power Apps Elevation of Privilege Vulnerability

Thu, 06 Aug 2026 00:00:00 +0000

Improper authorization in Microsoft Power Apps allows an unauthorized attacker to elevate privileges over a network. Published in August 2026 Early Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:N/A.

Azure SRE Agent Elevation of Privilege Vulnerability

Thu, 06 Aug 2026 00:00:00 +0000

Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network. Published in August 2026 Early Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely.

Azure SQL Managed Instance Elevation of Privilege Vulnerability

Thu, 06 Aug 2026 00:00:00 +0000

Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an unauthorized attacker to elevate privileges over a network. Published in August 2026 Early Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:N/A.

Azure Entra ID Spoofing Vulnerability

Thu, 06 Aug 2026 00:00:00 +0000

Insufficient verification of data authenticity in Azure Entra ID allows an authorized attacker to perform spoofing over a network. Published in August 2026 Early Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:N/A.

Microsoft Teams Elevation of Privilege Vulnerability

Thu, 06 Aug 2026 00:00:00 +0000

Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network. Published in August 2026 Early Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:N/A.

Microsoft Teams Spoofing Vulnerability

Thu, 06 Aug 2026 00:00:00 +0000

Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network. Published in August 2026 Early Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:N/A.

Azure SQL Database Elevation of Privilege Vulnerability

Thu, 06 Aug 2026 00:00:00 +0000

Incorrect permission assignment for critical resource in Azure SQL Database allows an authorized attacker to elevate privileges locally. Published in August 2026 Early Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:N/A.

KVM: nVMX: Hide shadow VMCS right after VMCLEAR

Thu, 06 Aug 2026 00:00:00 +0000

KVM: nVMX: Hide shadow VMCS right after VMCLEAR Published in August 2026 Early Security Updates.

sctp: don't free the ASCONF's own transport in DEL-IP processing

Thu, 06 Aug 2026 00:00:00 +0000

sctp: don't free the ASCONF's own transport in DEL-IP processing Published in August 2026 Early Security Updates.

Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data()

Thu, 06 Aug 2026 00:00:00 +0000

Input: ims-pcu - fix heap-buffer-overflow in ims_pcu_process_data() Published in August 2026 Early Security Updates.

usb: gadget: f_midi: cancel pending IN work before freeing the midi object

Thu, 06 Aug 2026 00:00:00 +0000

usb: gadget: f_midi: cancel pending IN work before freeing the midi object Published in August 2026 Early Security Updates.

btrfs: do not trim a device which is not writeable

Thu, 06 Aug 2026 00:00:00 +0000

btrfs: do not trim a device which is not writeable Published in August 2026 Early Security Updates.

usb: gadget: f_fs: initialize reset_work at allocation time

Thu, 06 Aug 2026 00:00:00 +0000

usb: gadget: f_fs: initialize reset_work at allocation time Published in August 2026 Early Security Updates.

Microsoft Teams Elevation of Privilege Vulnerability

Thu, 06 Aug 2026 00:00:00 +0000

Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network. Published in August 2026 Early Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:N/A.

Microsoft Purview eDiscovery Elevation of Privilege Vulnerability

Thu, 06 Aug 2026 00:00:00 +0000

Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network. Published in August 2026 Early Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:N/A.

x86/bugs: Make Safe-RET robust against interrupt injection

Thu, 06 Aug 2026 00:00:00 +0000

x86/bugs: Make Safe-RET robust against interrupt injection Published in August 2026 Early Security Updates.

Azure Confidential Ledger Remote Code Execution Vulnerability

Thu, 06 Aug 2026 00:00:00 +0000

Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute code over a network. Published in August 2026 Early Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:N/A.

Microsoft Office SharePoint Spoofing Vulnerability

Thu, 06 Aug 2026 00:00:00 +0000

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network. Published in August 2026 Early Security Updates. MSRC exploitability: Publicly Disclosed:No;Exploited:No;Latest Software Release:N/A.

PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

Thu, 06 Aug 2026 00:00:00 +0000

PDF.js: Arbitrary JavaScript execution upon opening a malicious PDF

Nx: Zip-Slip in the self-hosted remote cache

Thu, 06 Aug 2026 00:00:00 +0000

Nx: Zip-Slip in the self-hosted remote cache

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

Thu, 06 Aug 2026 00:00:00 +0000

JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported

ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633

Thu, 06 Aug 2026 00:00:00 +0000

ngx-extended-pdf-viewer bundles a version of pdf.js vulnerable to CVE-2026-16633

rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote

Wed, 05 Aug 2026 00:00:00 +0000

rclone: Unvalidated symlink target in local `--links` — arbitrary file write from an untrusted remote

rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, ove...

Wed, 05 Aug 2026 00:00:00 +0000

rclone `serve restic --private-repos` authorization bypass: `..` in the URL path lets an authenticated user read, overwrite and delete other users' repositories

rclone: Incomplete path validation allows backend root escape in serve restic

Wed, 05 Aug 2026 00:00:00 +0000

rclone: Incomplete path validation allows backend root escape in serve restic

rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution

Wed, 05 Aug 2026 00:00:00 +0000

rclone: PowerShell Smart-Quote Filename Injection Enables SFTP Server-Side Command Execution

JetBrains TeamCity Deserialization of Untrusted Data Vulnerability

Wed, 05 Aug 2026 00:00:00 +0000

JetBrains TeamCity contains a deserialization of untrusted data vulnerability that could allow unauthenticated remote code execution via the agent polling protocol.

Langflow Langflow — CVE-2026-8470 (Critical)

Wed, 05 Aug 2026 00:00:00 +0000

IBM Langflow OSS 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, 1.0.0 through 1.10.3, and 1.0.0 through 1.10.3 use Python's non-cryptographic random module for generating Fernet encryption keys from user secrets under 32 characters. The deterministic Mersenne Twister PRNG produces identical keys for identical seeds, allowing attackers to reproduce encryption keys and decrypt stored API keys and authentication tokens.

Langflow Langflow — CVE-2026-9205 (Critical)

Wed, 05 Aug 2026 00:00:00 +0000

IBM Langflow OSS contains a weak cryptographic key derivation vulnerability in the ensure_fernet_key() function.

Electron: Context isolation bypass via Function.prototype.bind hijack

Wed, 05 Aug 2026 00:00:00 +0000

Electron: Context isolation bypass via Function.prototype.bind hijack

Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

Wed, 05 Aug 2026 00:00:00 +0000

Electron: Custom protocol with supportFetchAPI but not corsEnabled allows cross-origin reads

Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

Wed, 05 Aug 2026 00:00:00 +0000

Electron: Sandboxed iframe can bypass the allow-popups restriction via the OpenURL navigation path

Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering

Wed, 05 Aug 2026 00:00:00 +0000

Nuxt: Unauthenticated out-of-memory crash via unbounded v-for expansion in island rendering

Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-20...

Wed, 05 Aug 2026 00:00:00 +0000

Nuxt route rules silently dropped for mixed-case paths, bypassing appMiddleware auth gates (incomplete fix for CVE-2026-53721)

Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients

Wed, 05 Aug 2026 00:00:00 +0000

Nuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients

Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host

Wed, 05 Aug 2026 00:00:00 +0000

Unauthenticated Nuxt DevTools RPC allows arbitrary command execution on the developer's host

Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

Wed, 05 Aug 2026 00:00:00 +0000

Nuxt: Server-Side Remote Code Execution via Runtime Template Injection in Nuxt Server Island Props

Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation

Wed, 05 Aug 2026 00:00:00 +0000

Nuxt: Unauthenticated CPU exhaustion parsing and hashing the Nuxt island endpoint body before hash validation

Apache Tomcat Missing Encryption of Sensitive Data Vulnerability

Tue, 04 Aug 2026 00:00:00 +0000

Apache Tomcat contains a missing encryption of sensitive data vulnerability that allows the bypass of the EncryptInterceptor.

IBM Langflow Code Injection Vulnerability

Tue, 04 Aug 2026 00:00:00 +0000

Langflow contains a code injection vulnerability that allows unauthenticated attackers to achieve full remote code execution on default Langflow deployments.

MaxSite CMS 109.5 and earlier — CVE-2026-70552 (Critical)

Tue, 04 Aug 2026 00:00:00 +0000

MaxSite CMS 109.5 and earlier contains an authentication bypass vulnerability in the AJAX dispatcher that allows unauthenticated attackers to access admin-gated endpoints by supplying any X-Requested-With header and requesting a base64-encoded path resolving to any *-ajax.php file in the codebase. Attackers can exploit this dispatcher bypass to reach privileged plugin endpoints without credentials, enabling actions such as manipulating poll states and vote counts, and amplifying the impact of any dangerous operation performed by admin-only ajax files across the plugin tree.

MaxSite CMS — CVE-2026-70553 (Critical)

Tue, 04 Aug 2026 00:00:00 +0000

MaxSite CMS contains a remote code execution vulnerability that allows unauthenticated attackers to inject arbitrary PHP code into the application configuration file by submitting crafted POST requests to the install endpoint after installation is complete. Attackers can supply a malicious db_dbprefix value containing a single quote to break out of a PHP string literal in application/config/database.php, appending attacker-controlled PHP statements that are executed by the web server on every subsequent request, resulting in persistent unauthenticated remote code execution as the web-server pr

MaxSite CMS — CVE-2026-70554 (Critical)

Tue, 04 Aug 2026 00:00:00 +0000

MaxSite CMS contains a PHP object injection vulnerability that allows unauthenticated attackers to execute arbitrary code by passing attacker-controlled serialized data in the maxsite_comuser cookie directly to unserialize() without validation or class allowlisting. Attackers can craft a malicious serialized PHP object payload delivered in a single HTTP request to trigger magic methods during object graph reconstruction, enabling property-oriented programming attacks or remote code execution via available gadget chains such as those targeting SoapClient or Imagick extensions.

N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

Tue, 04 Aug 2026 00:00:00 +0000

N-able N-central contains an authentication bypass using an alternate path or channel that allows for authentication bypass.

XSS in Ghost's ActivityPub client

Tue, 04 Aug 2026 00:00:00 +0000

XSS in Ghost's ActivityPub client

Flowise RCE via TypeORM DataSource

Tue, 04 Aug 2026 00:00:00 +0000

Flowise RCE via TypeORM DataSource

Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across work...

Tue, 04 Aug 2026 00:00:00 +0000

Flowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization

Flowise Sandbox Escape to RCE

Tue, 04 Aug 2026 00:00:00 +0000

Flowise Sandbox Escape to RCE

Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

Tue, 04 Aug 2026 00:00:00 +0000

Flowise: RCE via NodeVM Sandbox Escape in executeJavaScriptCode() nodeVMOptions Override

Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

Tue, 04 Aug 2026 00:00:00 +0000

Flowise: CSV Agent Remote Code Execution via Pyodide Code Injection — Root Shell Verified

Flowise: Remote Code Execution Vulnerability in CSVAgent

Tue, 04 Aug 2026 00:00:00 +0000

Flowise: Remote Code Execution Vulnerability in CSVAgent

Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses

Tue, 04 Aug 2026 00:00:00 +0000

Flowise: SSRF Protection Bypass via IPv4-Mapped IPv6 Addresses

Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Predic...

Tue, 04 Aug 2026 00:00:00 +0000

Flowise: Unauthenticated Property Injection into Flow Execution Context via Ungated `overrideConfig` Spread in Prediction API

Flowise RCE via SQLite Record Manager Node

Tue, 04 Aug 2026 00:00:00 +0000

Flowise RCE via SQLite Record Manager Node

Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:...

Tue, 04 Aug 2026 00:00:00 +0000

Flowise: `DELETE /api/v1/chatflows/:id` does not validate resource type, allowing `agentflows:delete` and `chatflows:delete` to delete each other’s flow type

Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

Tue, 04 Aug 2026 00:00:00 +0000

Flowise: CVE-2025-8943 Patch Bypass: npm_config_yes bypasses MCP environment variable blocklist (Unauthenticated RCE)

Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation

Tue, 04 Aug 2026 00:00:00 +0000

Flowise: RCE via CSVAgent csvFile data URI base64 segment is interpolated into Python source without validation

Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

Tue, 04 Aug 2026 00:00:00 +0000

Flowise: Pyodide validator Unicode homoglyph bypass leads to RCE

Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure

Tue, 04 Aug 2026 00:00:00 +0000

Flowise: RBAC Bypass Leading to Unauthorized Workspace Variables Disclosure

Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store

Tue, 04 Aug 2026 00:00:00 +0000

Flowise: Cross-workspace credential IDOR in openai-assistants-vector-store

Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

Tue, 04 Aug 2026 00:00:00 +0000

Flowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history

Flowise: Cross-Workspace OAuth2 Credential Metadata Leak

Tue, 04 Aug 2026 00:00:00 +0000

Flowise: Cross-Workspace OAuth2 Credential Metadata Leak

Flowise: Missing Authorization on Execution Update Endpoint

Tue, 04 Aug 2026 00:00:00 +0000

Flowise: Missing Authorization on Execution Update Endpoint

Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation

Tue, 04 Aug 2026 00:00:00 +0000

Flowise: Broken Access Control in Stripe Subscription Endpoints Allows Cross-Tenant Billing Manipulation

Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

Tue, 04 Aug 2026 00:00:00 +0000

Flowise: CSV Agent Prompt Injection Remote Code Execution Vulnerability

Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected ...

Tue, 04 Aug 2026 00:00:00 +0000

Flowise: Unauthenticated OAuth2 token refresh endpoint returns access tokens — enables token theft for any connected service

Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys

Tue, 04 Aug 2026 00:00:00 +0000

Flowise: Authenticated arbitrary file write in the `S3 Directory` document loader via unsanitized S3 object keys

Puwell IP Camera firmware — CVE-2026-61515 (Critical)

Tue, 04 Aug 2026 00:00:00 +0000

Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on TCP port 34567. Attackers can exploit the lack of authentication and input sanitization in the binary protocol service to pass arbitrary commands directly to the underlying operating system, achieving root-level code execution and complete device compromise.

Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader

Tue, 04 Aug 2026 00:00:00 +0000

Open WebUI: SSRF into internal services via unvalidated sub-resource requests in the Playwright web loader

Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client

Tue, 04 Aug 2026 00:00:00 +0000

Open WebUI: Account takeover via OAuth token exchange accepting tokens issued to any client

Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

Tue, 04 Aug 2026 00:00:00 +0000

Open WebUI: Any authenticated user can reach internal services and cloud metadata via NAT64-encoded URLs

Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin

Tue, 04 Aug 2026 00:00:00 +0000

Open WebUI: Same-origin XSS to account takeover via terminal file-preview iframe hardcoding allow-same-origin

Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages

Tue, 04 Aug 2026 00:00:00 +0000

Open WebUI: Stored XSS via unescaped KaTeX render-error fallback in rendered messages

Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder

Tue, 04 Aug 2026 00:00:00 +0000

Open WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder

Apache Nifi — CVE-2026-68979 (Critical)

Mon, 03 Aug 2026 00:00:00 +0000

Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Parameter values. Updating a Parameter Context can change parameter values that affect referencing components, but framework authorization was limited to read and write privileges on the Parameter Context itself. As a result of the missing authorization, an authenticated user authorized to modify a Parameter Context, but not authorized on referencing components, could alter Parameter values affecting those components. In deployments where a

Apache Nifi — CVE-2026-68980 (Critical)

Mon, 03 Aug 2026 00:00:00 +0000

Apache NiFi 2.0.0 through 2.10.0 support creating, reading, and deleting Assets associated with Parameter Contexts through the REST API. The framework authorizes asset deletion against the owning Parameter Context using the supplied Parameter Context Identifier and Asset Identifier. The framework performed authorized based on the supplied Parameter Context Identifier without verifying the requested Identifier against the stored Identifier. Apache NiFi installations that do not implement different levels of authorization across Parameter Contexts are not subject to this vulnerability, because t

Guzzle: Noncanonical host can bypass host-based checks

Mon, 03 Aug 2026 00:00:00 +0000

Guzzle: Noncanonical host can bypass host-based checks

Krayin CRM 2.2.4 — CVE-2026-41452 (Critical)

Mon, 03 Aug 2026 00:00:00 +0000

Krayin CRM 2.2.4 contains a missing authentication vulnerability in the installer middleware that allows unauthenticated remote attackers to overwrite the primary administrator account by sending a crafted HTTP POST request with the X-Requested-With: XMLHttpRequest header to bypass the CanInstall middleware redirect check. Attackers can supply arbitrary name, email, and password values to the admin-config-setup endpoint, which performs an unauthenticated updateOrInsert targeting the hardcoded administrator user ID, enabling full administrative access to all CRM data.

N-able N-central Authentication Bypass Using an Alternate Path or Channel Vulnerability

Mon, 03 Aug 2026 00:00:00 +0000

N-able N-central contains an authentication bypass using an alternate path or channel allows for authentication bypass and account takeover in N-central. This vulnerability is the result of an incomplete patch for CVE-2026-18556.

undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

Mon, 03 Aug 2026 00:00:00 +0000

undici vulnerable to cross-user information disclosure and parse-time crash via degenerate private cache directives

fast-uri vulnerable to host confusion via backslash authority introducer

Mon, 03 Aug 2026 00:00:00 +0000

fast-uri vulnerable to host confusion via backslash authority introducer

Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

Mon, 03 Aug 2026 00:00:00 +0000

Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning

Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

Mon, 03 Aug 2026 00:00:00 +0000

Angular SSR: Missing Fallback Raw-Content Serialization Escaping leads to Cross-Site Scripting (XSS)

Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

Mon, 03 Aug 2026 00:00:00 +0000

Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

Mon, 03 Aug 2026 00:00:00 +0000

brace-expansion: DoS via unbounded intermediate arrays, bypassing the CVE-2026-14257 mitigation

Socket.IO: Zero-attachment Memory Exhaustion

Mon, 03 Aug 2026 00:00:00 +0000

Socket.IO: Zero-attachment Memory Exhaustion

ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and t...

Mon, 03 Aug 2026 00:00:00 +0000

ip-address: Address4 decodes leading-zero octets as decimal while resolvers decode them as octal, allowing SSRF and trust-boundary bypass

Sequelize: SQL Injection (Oracle DB)

Mon, 03 Aug 2026 00:00:00 +0000

Sequelize: SQL Injection (Oracle DB)

AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

Mon, 03 Aug 2026 00:00:00 +0000

AIOHTTP: Out-of-bounds heap read in C HTTP response parser error path (malformed chunked response)

cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

Mon, 03 Aug 2026 00:00:00 +0000

cryptography: PKCS#7 EnvelopedData decryption exposes a Bleichenbacher oracle through distinguishable errors and timing

python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

Mon, 03 Aug 2026 00:00:00 +0000

python-cryptography: Duplicate self-signed intermediates can cause exponential path-building

GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file o...

Mon, 03 Aug 2026 00:00:00 +0000

GitPython: Unguarded git option forwarding in IndexFile.checkout() and TagReference.create() enables arbitrary file overwrite and arbitrary file read

Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache...

Fri, 31 Jul 2026 00:00:00 +0000

Redaxo has a Mediapool isAllowedExtension bypass via multi-segment filename that leads to authenticated RCE on Apache mod_php multi-extension handlers

Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhook

Fri, 31 Jul 2026 00:00:00 +0000

Sylius Mollie Plugin vulnerable to payment status forgery via the payment webhook

Wings exposes node configuration secrets through egg configuration-file templating

Fri, 31 Jul 2026 00:00:00 +0000

Wings exposes node configuration secrets through egg configuration-file templating

Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

Fri, 31 Jul 2026 00:00:00 +0000

Wings: Maliciously crafted packet during SFTP connection handshake causes denial of service

vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount...

Fri, 31 Jul 2026 00:00:00 +0000

vault-addr annotation SSRF -- webhook makes outbound HTTP call to attacker URL during admission; vault-serviceaccount enables cluster-wide SA token theft via TokenRequest API

FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files

Fri, 31 Jul 2026 00:00:00 +0000

FileBrowser Quantum's path traversal issue in subtitle handler allows any authenticated user to read arbitrary files

Spring Data: Unbounded property-path cache keyed by externally-supplied path string

Fri, 31 Jul 2026 00:00:00 +0000

Spring Data: Unbounded property-path cache keyed by externally-supplied path string

Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct mem...

Fri, 31 Jul 2026 00:00:00 +0000

Netty: HTTP/2 decompression leaks ByteBuf reference count when the decompressor channel is already closed (Direct memory leak / OOM DoS)

VU#243636: VPS.org one-click deployment templates contain multiple vulnerabilities

Fri, 31 Jul 2026 00:00:00 +0000

Overview VPS.org's one-click deployment templates provision services with default passwords and predefined network bindings instead of generating randomized secrets or applying per-deployment hardening measures. Description VPS.org is a cloud and virtual private server hosting provider that offers a library of templates for quickly provisioning common applications and services. Multiple vulnerabilities exist in the one-click deployment templates feature. These vulnerabilities stem from the same root cause: content is directly instantiated from static templates, using default passwords and static secrets with no deployment-specific randomization or interface-binding hardening at provisioning time. CVE-2026-16503 The Supabase template provides an instance of PostgreSQL that is bound to all network interfaces (0.0.0.0:5432) and uses the... Related CVEs: CVE-2026-16503, CVE-2026-16504.

NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE

Fri, 31 Jul 2026 00:00:00 +0000

NocoBase: SQL injection in /api/myInAppChannels:list filter to PG-superuser RCE

@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag

Fri, 31 Jul 2026 00:00:00 +0000

@apostrophecms/seo Vulnerable to Stored XSS via Unsanitized Google Analytics / GTM ID Injected into Script Tag

Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide author...

Fri, 31 Jul 2026 00:00:00 +0000

Apostrophe has Server-Side Prototype Pollution in apos.util.set via patch operators that leads to process-wide authorization bypass

dssrf: any users using 1.1.1.1 DNS is impacted by SSRF

Fri, 31 Jul 2026 00:00:00 +0000

dssrf: any users using 1.1.1.1 DNS is impacted by SSRF

@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging

Fri, 31 Jul 2026 00:00:00 +0000

@phun-ky/defaults-deep Has a Prototype Pollution issue via Unsafe Recursive Property Merging

hashi-vault-js has a path traversal and query parameter injection

Fri, 31 Jul 2026 00:00:00 +0000

hashi-vault-js has a path traversal and query parameter injection

Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier

Fri, 31 Jul 2026 00:00:00 +0000

Jodit Editor: Mutation XSS in jodit clean-html via a MathML/style rawtext carrier

`@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation

Fri, 31 Jul 2026 00:00:00 +0000

`@dynatrace-oss/dynatrace-mcp-server` has Unauthenticated HTTP MCP Tool Invocation

Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex

Fri, 31 Jul 2026 00:00:00 +0000

Natural Language Toolkit (NLTK): ReDoS in NLTK ReviewsCorpusReader FEATURES regex

Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nlt...

Fri, 31 Jul 2026 00:00:00 +0000

Natural Language Toolkit (NLTK): Path Traversal in NKJPCorpusReader leads to Arbitrary File Read and bypasses the nltk.pathsec sandbox (ENFORCE=True)

Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file rea...

Fri, 31 Jul 2026 00:00:00 +0000

Natural Language Toolkit (NLTK) has path traversal in FramenetCorpusReader.frame() that allows arbitrary XML file read, bypassing the nltk.pathsec sandbox (ENFORCE=True)

Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data....

Fri, 31 Jul 2026 00:00:00 +0000

Natural Language Toolkit (NLTK): DNS-rebinding SSRF filter bypass in nltk.pathsec.urlopen (nltk.download / nltk.data.load) defeats ENFORCE mode

Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

Fri, 31 Jul 2026 00:00:00 +0000

Thumbor treats ALLOWED_SOURCES string patterns as unescaped regex, allowing hostname bypass via wildcard dot

Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature

Fri, 31 Jul 2026 00:00:00 +0000

Thumbor has HMAC validation bypass via multiple .replace() calls when removing URL signature

Thumbor has path traversal via post-validation URL decoding bypass in file_loader

Fri, 31 Jul 2026 00:00:00 +0000

Thumbor has path traversal via post-validation URL decoding bypass in file_loader

Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS

Fri, 31 Jul 2026 00:00:00 +0000

Thumbor convolution filter allows divide-by-zero in C extension leading to remote DoS

Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter

Fri, 31 Jul 2026 00:00:00 +0000

Thumbor has Regex Denial of Service (ReDoS) in `convolution` filter

Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS

Fri, 31 Jul 2026 00:00:00 +0000

Thumbor proportion filter allows unbounded post-transform resize leading to remote DoS

Savon::Model evaluates WSDL operation names as Ruby source

Fri, 31 Jul 2026 00:00:00 +0000

Savon::Model evaluates WSDL operation names as Ruby source

OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)

Thu, 30 Jul 2026 00:00:00 +0000

OliveTin: Unauthenticated DoS via OAuth2 State Memory Exhaustion (Unbounded Map Growth)

VU#790363: foreUP golf management platform's web API contains multiple vulnerabilities

Thu, 30 Jul 2026 00:00:00 +0000

Overview Two vulnerabilities in the REST API were found in Golf Compete foreUP. The first exposes the merchant, Finix, API credentials directly in customer record responses, allowing any user to obtain and use the payment processor account. The second is a missing object-level authorization check, which lets a user retrieve any other customer's full profile, payment token, and transaction history by changing the golfer_id in the request path. Description Golf Compete foreUP provides cloud-based golf course management software to over 2,000 golf courses. They offer tools that allow the management of customers, inventory, tee times, food & beverages, marketing, billing, etc. The vulnerabilities identified are listed below. CVE-2026-15657 A vulnerability in the foreUP customer REST API exposes merchant credentials. Each customer record... Related CVEs: CVE-2026-15657, CVE-2026-15658.

AWS Amplify Studio UI Component Properties Has an Input Validation Issue

Thu, 30 Jul 2026 00:00:00 +0000

AWS Amplify Studio UI Component Properties Has an Input Validation Issue

dssrf has an SSRF bypass with remove_at_symbol_in_string

Thu, 30 Jul 2026 00:00:00 +0000

dssrf has an SSRF bypass with remove_at_symbol_in_string

OpenClaw Dashboard v3.0.0 — CVE-2026-66418 (Critical)

Thu, 30 Jul 2026 00:00:00 +0000

OpenClaw Dashboard v3.0.0 contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to inject arbitrary HTML and script payloads by submitting a crafted username in a failed login POST request, which is recorded verbatim in the audit log. When an administrator opens the notification panel, the unescaped log entry is rendered via innerHTML with a permissive Content-Security-Policy allowing inline event handlers, enabling the attacker-supplied payload to execute in the administrator's session and interact with authenticated endpoints including agent instru

OpenClaw Dashboard — CVE-2026-66421 (Critical)

Thu, 30 Jul 2026 00:00:00 +0000

OpenClaw Dashboard contains a stored cross-site scripting vulnerability that allows unauthenticated remote attackers to execute arbitrary JavaScript in the administrator's browser session by injecting HTML markup into agent transcript messages processed through the sessions API. Attackers can craft a message containing inline event handler payloads such as an img tag with an onerror attribute within the 60-character rendering budget, which is stored in the session transcript and interpolated unsanitized into innerHTML on the default landing page, allowing theft of session tokens and unauthoriz

Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation

Thu, 30 Jul 2026 00:00:00 +0000

Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation

Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url

Thu, 30 Jul 2026 00:00:00 +0000

Flyto2 Core: LLM/API keys leak to an attacker-controlled base_url

Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration

Thu, 30 Jul 2026 00:00:00 +0000

Flyto2 Core: Unauthenticated flyto-verification /run: callback_url SSRF and internal runner-secret exfiltration

Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted

Thu, 30 Jul 2026 00:00:00 +0000

Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted

Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (S...

Thu, 30 Jul 2026 00:00:00 +0000

Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)

Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

Thu, 30 Jul 2026 00:00:00 +0000

Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)

Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing

Thu, 30 Jul 2026 00:00:00 +0000

Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing

MCP Ruby SDK: Ruby SSE Session Poisoning

Thu, 30 Jul 2026 00:00:00 +0000

MCP Ruby SDK: Ruby SSE Session Poisoning

MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport

Thu, 30 Jul 2026 00:00:00 +0000

MCP Ruby SDK: Unbounded JSON-RPC request body causes uncontrolled memory allocation in StreamableHTTPTransport

VU#281278: SGLang contains six different vulnerabilities including RCE, data exfiltration, and credential disclosure

Thu, 30 Jul 2026 00:00:00 +0000

Overview Six vulnerabilities have been discovered within the SGLang project, including remote code execution (RCE), server-side request forgery (SSRF), local file read, credential leakage, and model weight exfiltration on a target server. Exploitation does not require authentication in most cases, and some vulnerabilities require only network access with no API keys or user credentials. At the time of publication, no patches are available from the project maintainers, and coordination attempts have been unsuccessful. Description SGLang is an open-source framework for serving large language models (LLMs) and multimodal AI models, supporting models such as Qwen, DeepSeek, Mistral, and Skywork, and is compatible with OpenAI APIs. Six vulnerabilities have been discovered within the tool and are tracked as follows: CVE-2026-15969 SGLang... Related CVEs: CVE-2026-14890, CVE-2026-15969, CVE-2026-15971, CVE-2026-15974.

Care Everywhere Gateway 14.3.10 — CVE-2026-41939 (Critical)

Wed, 29 Jul 2026 00:00:00 +0000

Care Everywhere Gateway 14.3.10 contains a hard-coded credentials vulnerability in the bundled WildFly 8.2.0.Final management interface that allows unauthenticated remote attackers to gain administrative access by using default credentials identical across all installations. Attackers can authenticate to the exposed WildFly management console on port 20990 and deploy a malicious Web Application Archive file through the Deployments interface to achieve remote code execution as the Windows machine account. Version 14.x.x was declared end-of-life (EOL) in 2017 and future releases have addressed t

Cisco Secure Firewall Management Center Use of Hard-coded Password Vulnerability

Wed, 29 Jul 2026 00:00:00 +0000

Cisco Secure Firewall Management Center (FMC) formerly known as Firepower Management Center contains a use of hard-coded password vulnerability that could allow an unauthenticated, remote attacker to log in to an affected device using a low-privileged account to access sensitive data within the impacted systems.

Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure

Wed, 29 Jul 2026 00:00:00 +0000

Easy!Appointments Vulnerable to Appointments Takeover via Excessive Data Exposure

VU#293714: Arbitrary File Overwrite in Develar app-builder (zipx.Unzip) via Symlink Following on macOS (APFS)

Wed, 29 Jul 2026 00:00:00 +0000

Overview A vulnerability in the zipx.Unzip extraction routine of Develar’s app-builder allows an attacker to overwrite arbitrary files on macOS using Apple File System (APFS). The issue arises from a combination of Unicode normalization collisions and unsafe symlink-following behavior. APFS treats certain Unicode equivalent filenames as identical (e.g., ß ↔ ss), while app builder performs no canonical normalization before validating or writing paths. Description Develar’s app-builder is a command‑line build tool used heavily in the Electron ecosystem to package, sign, notarize, and produce distributable application bundles for macOS, Windows, and Linux. It is popular because it is a transitive dependency of electron-builder, one of the most widely used packaging tools for Electron apps. The vulnerability arises from how the zipx.Unzip...

Req vulnerable to unbounded archive/compression extraction triggered by response content-type

Wed, 29 Jul 2026 00:00:00 +0000

Req vulnerable to unbounded archive/compression extraction triggered by response content-type

Logging operator has Fluentd configuration injection that allows remote code execution

Wed, 29 Jul 2026 00:00:00 +0000

Logging operator has Fluentd configuration injection that allows remote code execution

ZITADEL Users Can Self-Verify Email/Phone via API

Wed, 29 Jul 2026 00:00:00 +0000

ZITADEL Users Can Self-Verify Email/Phone via API

prebid-server's request forgery vulnerability allows for possible host environment data extraction

Wed, 29 Jul 2026 00:00:00 +0000

prebid-server's request forgery vulnerability allows for possible host environment data extraction

netfoil: Incorrect block responses could lead to localhost traffic

Wed, 29 Jul 2026 00:00:00 +0000

netfoil: Incorrect block responses could lead to localhost traffic

Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

Wed, 29 Jul 2026 00:00:00 +0000

Quarkus: Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

veraPDF Validation XXE via Rich Text

Wed, 29 Jul 2026 00:00:00 +0000

veraPDF Validation XXE via Rich Text

veraPDF Validation XXE via XFA

Wed, 29 Jul 2026 00:00:00 +0000

veraPDF Validation XXE via XFA

AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote Escaping

Wed, 29 Jul 2026 00:00:00 +0000

AgentCore CLI Bedrock Agent Import Vulnerable to Code Injection via Improper Triple-Quote Escaping

swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`

Wed, 29 Jul 2026 00:00:00 +0000

swagger-typescript-api vulnerable to authorization-token exfiltration via spec `$ref`

swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template

Wed, 29 Jul 2026 00:00:00 +0000

swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in axios http-client template

swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template

Wed, 29 Jul 2026 00:00:00 +0000

swagger-typescript-api vulnerable to code injection via unescaped `servers[0].url` in fetch http-client template

swagger-typescript-api vulnerable to code injection via unescaped enum string values

Wed, 29 Jul 2026 00:00:00 +0000

swagger-typescript-api vulnerable to code injection via unescaped enum string values

swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies

Wed, 29 Jul 2026 00:00:00 +0000

swagger-typescript-api vulnerable to code injection via unescaped OpenAPI path strings in generated method bodies

VU#305509: OPeNDAP Hyrax is vulnerable to SSRF and Credential Disclosure

Wed, 29 Jul 2026 00:00:00 +0000

Overview A vulnerability has been discovered in the OPeNDAP Hyrax software solution. A remote attacker with the ability to submit crafted requests to an affected Hyrax instance could cause the application to communicate with unauthorized remote systems. Under certain conditions, the vulnerability may also result in the unintended disclosure of user authentication tokens to unauthorized destinations. Description CVE-2026-16637 OPeNDAP Hyrax is vulnerable to Server Side Request Forgery (SSRF) and credential disclosure via unvalidated HTTP redirects that bypass the AllowedHosts allowlist and leak Earthdata headers (User-Id, Echo-Token) to attacker-controlled endpoints. OPeNDAP Hyrax is an open-source data server software that enables remote access to scientific datasets over the internet using the OPeNDAP protocol. It allows users to query... Related CVEs: CVE-2026-16637.

`proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive

Wed, 29 Jul 2026 00:00:00 +0000

`proot-distro install` has a Symlink Escape (Arbitrary Host File Write) via Malicious Tar Archive

proot-distro has a Container Isolation Bypass via Crafted Restore Archive

Wed, 29 Jul 2026 00:00:00 +0000

proot-distro has a Container Isolation Bypass via Crafted Restore Archive

Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.

Tue, 28 Jul 2026 00:00:00 +0000

Poweradmin has Host Header Injection in OIDC redirect_uri, SAML ACS/SLO URL, and Logout Redirect Construction.

Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

Tue, 28 Jul 2026 00:00:00 +0000

Pterodactyl's improper JWT scoping allows subuser to upload files when not explicitly granted `file.create` permissions

Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authenticat...

Tue, 28 Jul 2026 00:00:00 +0000

Pterodactyl's shared global rate-limit key on login and 2FA checkpoint enables unauthenticated panel-wide authentication lockout (DoS)

Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory

Tue, 28 Jul 2026 00:00:00 +0000

Fission: Zip Slip in pkg/utils/zip.go:Unarchive allows fetcher to write outside the destination directory

Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME a...

Tue, 28 Jul 2026 00:00:00 +0000

Fission: Incomplete capability denylist in Environment/Function PodSpec validation allows tenant-added CAP_SYS_TIME and cross-tenant node wall-clock corruption

td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode

Tue, 28 Jul 2026 00:00:00 +0000

td has pre-auth denial of service via unbounded memory allocation in proto.UnencryptedMessage.Decode

openhole-server vulnerable to path traversal via URL-decoded request path

Tue, 28 Jul 2026 00:00:00 +0000

openhole-server vulnerable to path traversal via URL-decoded request path

goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of...

Tue, 28 Jul 2026 00:00:00 +0000

goshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of GHSA-wvhv-qcqf-f3cx)

goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

Tue, 28 Jul 2026 00:00:00 +0000

goshs SFTP authentication bypass via empty password (incomplete fix of CVE-2026-40884)

goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

Tue, 28 Jul 2026 00:00:00 +0000

goshs --no-delete WebDAV MOVE bypass allows file deletion/overwrite

VU#141367: AT&T's Arris BGW210-700 gateway contains authentication bypass vulnerability in LAN-side management interface

Tue, 28 Jul 2026 00:00:00 +0000

Overview Firmware versions 2.7.7 and earlier of the Arris BGW210-700 residential gateway contain an authentication bypass vulnerability, tracked as CVE-2026-16771, that allows any unauthenticated LAN-side user to read sensitive configuration data and modify device settings through web management endpoints. Although this vulnerability was recently discovered, the majority of in-service gateways are not expected to be running the affected version. Only devices that have not received automated ISP-managed firmware updates since version 2.7.7 in 2020 are vulnerable. Description The Arris BGW210-700 is a residential gateway used widely in AT&T deployments to provide routing, wireless networking, and wide-area network (WAN) connectivity for home users. The device exposes a browser-based management interface on the local-area network (LAN) side... Related CVEs: CVE-2026-16771.

QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding

Tue, 28 Jul 2026 00:00:00 +0000

QTINeon has unauthenticated relay-to-host amplification via unbounded RECONNECT_REQUEST forwarding

Style Dictionary - Prototype Pollution in convertTokenData utility function

Tue, 28 Jul 2026 00:00:00 +0000

Style Dictionary - Prototype Pollution in convertTokenData utility function

@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution

Tue, 28 Jul 2026 00:00:00 +0000

@hypequery/clickhouse has SQL Injection in parameter escaping that allows arbitrary SQL execution

Microsoft Security Advisory CVE-2026-32203 – .NET and Visual Studio Denial of Service Vulnerability

Tue, 28 Jul 2026 00:00:00 +0000

Microsoft Security Advisory CVE-2026-32203 – .NET and Visual Studio Denial of Service Vulnerability

SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)

Tue, 28 Jul 2026 00:00:00 +0000

SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)

`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description

Tue, 28 Jul 2026 00:00:00 +0000

`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in GraphQL Union description

pytonapi has a Webhook Custom Path Authentication Bypass

Tue, 28 Jul 2026 00:00:00 +0000

pytonapi has a Webhook Custom Path Authentication Bypass

`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field

Tue, 28 Jul 2026 00:00:00 +0000

`datamodel-code-generator` vulnerable to code injection in via attacker-controlled `default_factory` schema field

`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `com...

Tue, 28 Jul 2026 00:00:00 +0000

`datamodel-code-generator` vulnerable to code injection via unescaped carriage return in `--extra-template-data` `comment` field

`datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamo...

Tue, 28 Jul 2026 00:00:00 +0000

`datamodel-code-generator` vulnerable to code execution on import via `x-python-type` JSON-Schema extension in datamodel-code-generator

`datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-templ...

Tue, 28 Jul 2026 00:00:00 +0000

`datamodel-code-generator` vulnerable to code execution on import via unescaped `validators` entries in --extra-template-data

datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)

Tue, 28 Jul 2026 00:00:00 +0000

datamodel-code-generator vulnerable to SSRF via JSON-Schema `$ref` to HTTP URL (silent by default)

datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects

Tue, 28 Jul 2026 00:00:00 +0000

datamodel-code-generator vulnerable to SSRF via --url: no host/IP validation, follows redirects

datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversa...

Tue, 28 Jul 2026 00:00:00 +0000

datamodel-code-generator vulnerable to arbitrary local file read via JSON-Schema `$ref` (`file://` and `../` traversal), bypassing `--no-allow-remote-refs`

datamodel-code-generator vulnerable to arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) ...

Tue, 28 Jul 2026 00:00:00 +0000

datamodel-code-generator vulnerable to arbitrary local file read via XSD `schemaLocation` (`xs:include`/`xs:import`) path traversal, with no remote-ref gate

datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding

Tue, 28 Jul 2026 00:00:00 +0000

datamodel-code-generator vulnerable to SSRF protection bypass via DNS rebinding

datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import st...

Tue, 28 Jul 2026 00:00:00 +0000

datamodel-code-generator vulnerable to code injection via `x-python-import` / `customTypePath` in generated import statements

OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to atta...

Tue, 28 Jul 2026 00:00:00 +0000

OAuth2::Client#request: Protocol-relative redirect Location overrides authority, leaking bearer Authorization to attacker host

OAuth: Cross-origin token-request redirects can expose signed request metadata

Tue, 28 Jul 2026 00:00:00 +0000

OAuth: Cross-origin token-request redirects can expose signed request metadata

lettre has TLS hostname verification disabled when using Boring TLS backend

Tue, 28 Jul 2026 00:00:00 +0000

lettre has TLS hostname verification disabled when using Boring TLS backend

Apache Thrift — CVE-2026-48144 (Critical)

Mon, 27 Jul 2026 00:00:00 +0000

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Apache Thrift — CVE-2026-55971 (Critical)

Mon, 27 Jul 2026 00:00:00 +0000

Heap-based Buffer Overflow vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Apache Thrift — CVE-2026-58023 (Critical)

Mon, 27 Jul 2026 00:00:00 +0000

Out-of-bounds Read vulnerability in Apache Thrift c_glib bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Apache Thrift — CVE-2026-58662 (Critical)

Mon, 27 Jul 2026 00:00:00 +0000

Improper Validation of Specified Quantity in Input, Out-of-bounds Read vulnerability in Apache Thrift C++ bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue.

Arista VeloCloud Orchestrator On-Prem OS Command Injection Vulnerability

Mon, 27 Jul 2026 00:00:00 +0000

Arista VeloCloud Orchestrator On-Prem contains an OS command injection vulnerability that may allow a remote attacker to access privileged internal functionality and impact the VCO host. Successful exploitation may compromise the confidentiality, integrity, and availability of the orchestrator and data managed by the orchestrator.

Fortinet FortiOS Exposure of Sensitive Information to an Unauthorized Actor Vulnerability

Mon, 27 Jul 2026 00:00:00 +0000

Fortinet FortiOS contains an exposure of sensitive information to an unauthorized actor vulnerability. This may allow a remote unauthenticated attacker to bypass the patch developed for the symbolic link persistency mechanism observed in some post-exploit cases, via crafted HTTP requests. An attacker would need first to have compromised the product via another vulnerability, at filesystem level.

Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password

Fri, 24 Jul 2026 00:00:00 +0000

Pheditor: Authentication Bypass in Forced Password-Change Flow via Unverified Current Password

etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline

Fri, 24 Jul 2026 00:00:00 +0000

etcd: `tlsListener.acceptLoop` spawns unbounded handshake goroutines with no deadline

Oh My Posh: Arbitrary command execution via template injection in the path segment

Fri, 24 Jul 2026 00:00:00 +0000

Oh My Posh: Arbitrary command execution via template injection in the path segment

OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal

Fri, 24 Jul 2026 00:00:00 +0000

OpenList: Authenticated users can rename files outside their base path via batch rename `src_name` traversal

kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

Fri, 24 Jul 2026 00:00:00 +0000

kin-openapi: ValidationHandler.Load() Fail-Open Authentication Bypass via NoopAuthenticationFunc Default

etcd: Watch API authorization bypass via open-ended range requests

Fri, 24 Jul 2026 00:00:00 +0000

etcd: Watch API authorization bypass via open-ended range requests

OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

Fri, 24 Jul 2026 00:00:00 +0000

OpenAM: WebAuthn Java deserialization RCE via ObjectInputFilter depth>1 bypass

OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

Fri, 24 Jul 2026 00:00:00 +0000

OpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallback

blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)

Fri, 24 Jul 2026 00:00:00 +0000

blaze: Chunked-body trailer fields promoted into Request.headers in blaze-server (front-end header-sanitization bypass)

OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway

Fri, 24 Jul 2026 00:00:00 +0000

OpenDJ unauthenticated SSRF, local file read and unbounded-read DoS in the DSMLv2 gateway

blaze: Unbounded WebSocket message aggregation in http4s-blaze-server

Fri, 24 Jul 2026 00:00:00 +0000

blaze: Unbounded WebSocket message aggregation in http4s-blaze-server

OmniFaces: Forged combined-resource IDs and related output/push boundaries

Fri, 24 Jul 2026 00:00:00 +0000

OmniFaces: Forged combined-resource IDs and related output/push boundaries

blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

Fri, 24 Jul 2026 00:00:00 +0000

blaze: Multiple HTTP/1.1 request-smuggling primitives in blaze's Java wire parser

OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check

Fri, 24 Jul 2026 00:00:00 +0000

OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check

seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

Fri, 24 Jul 2026 00:00:00 +0000

seroval: `seroval.fromJSON()` Promise resolver type confusion invokes attacker-controlled methods during deserialization

Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)

Fri, 24 Jul 2026 00:00:00 +0000

Velocity.js: Remote Code Execution via property-read to Function constructor (bypass of GHSA-j658-c2gf-x6pq fix)

Shescape: Quadratic-time denial of service in the flag-protection

Fri, 24 Jul 2026 00:00:00 +0000

Shescape: Quadratic-time denial of service in the flag-protection

Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified

Fri, 24 Jul 2026 00:00:00 +0000

Budibase: OIDC SSO account takeover: incoming identity linked by email without checking email_verified

Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak

Fri, 24 Jul 2026 00:00:00 +0000

Budibase: Unauthenticated REST Datasource Credential Theft via Cross-Origin Auth Leak

Budibase: SQL Injection via `multipleStatements: true`

Fri, 24 Jul 2026 00:00:00 +0000

Budibase: SQL Injection via `multipleStatements: true`

@better-auth/scim: account takeover and stale access via SCIM provider-id collision

Fri, 24 Jul 2026 00:00:00 +0000

@better-auth/scim: account takeover and stale access via SCIM provider-id collision

sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock

Fri, 24 Jul 2026 00:00:00 +0000

sm-crypto: Predictable SM2 key generation in Node.js: default RNG uses Math.random + wall clock

Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer

Fri, 24 Jul 2026 00:00:00 +0000

Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer

Shescape: Shell injection via unescaped parentheses on Windows with CMD

Fri, 24 Jul 2026 00:00:00 +0000

Shescape: Shell injection via unescaped parentheses on Windows with CMD

Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions

Fri, 24 Jul 2026 00:00:00 +0000

Microsoft Kiota: Path/URL injection into generated Copilot plugin manifest via x-ai-* extensions

Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`

Fri, 24 Jul 2026 00:00:00 +0000

Microsoft Kiota: Command injection via x-ms-kiota-info dependencyInstallCommand surfaced by `kiota info`

AWS API MCP Server Security Policy Bypass via Startup Initialization Failure

Fri, 24 Jul 2026 00:00:00 +0000

AWS API MCP Server Security Policy Bypass via Startup Initialization Failure

AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()

Fri, 24 Jul 2026 00:00:00 +0000

AWS Bedrock AgentCore: Improper neutralization of argument delimiters in the Python SDK install_packages()

libp2p: yamux connection DoS via oversized data frame

Fri, 24 Jul 2026 00:00:00 +0000

libp2p: yamux connection DoS via oversized data frame

Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthent...

Fri, 24 Jul 2026 00:00:00 +0000

Smithy-RS: Allocation of resources without limits in the default aws-smithy-http-server serve() path allows unauthenticated Slowloris denial of service

PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

Thu, 23 Jul 2026 00:00:00 +0000

PHPSpreadsheet: SSRF bypass via HTTP redirect in WEBSERVICE() domain whitelist

PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion

Thu, 23 Jul 2026 00:00:00 +0000

PHPSpreadsheet: Gnumeric reader unbounded gzip expansion causes memory exhaustion

PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

Thu, 23 Jul 2026 00:00:00 +0000

PHPSpreadsheet: XLS/OLE sector-chain self-loop causes memory exhaustion

VU#492466: Logto Identity Platform has authentication and authorization failures in core protocol handling

Thu, 23 Jul 2026 00:00:00 +0000

Overview The Logto platform contains multiple vulnerabilities affecting the identity‑processing pipeline. These flaws reduce the reliability of authentication and authorization decisions and may allow attackers to bypass account‑ownership checks, skip MFA, replay externally issued SSO responses, or submit identity assertions without proper cryptographic or validity checks. Collectively, the issues create several paths for unauthorized access across both local and federated sign‑in flows. Description Developed by Silverhand Inc., Logto is an identity and access management system for software as a service (SaaS) and AI applications. It provides multi‑tenant authentication, single sign-on (SSO), role-based access control (RBAC), support for openId connect (OIDC), open authorization (OAuth) 2.1, and Security Assertion Markup Language (SAML)... Related CVEs: CVE-2026-15611, CVE-2026-15612, CVE-2026-15614, CVE-2026-15615.

PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

Thu, 23 Jul 2026 00:00:00 +0000

PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments

find-my-way: DDoS with HTTP2

Thu, 23 Jul 2026 00:00:00 +0000

find-my-way: DDoS with HTTP2

Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

Thu, 23 Jul 2026 00:00:00 +0000

Auth.js: Email normalizer validates the address before Unicode normalization, allowing a homoglyph @ bypass

Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

Thu, 23 Jul 2026 00:00:00 +0000

Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers

Thu, 23 Jul 2026 00:00:00 +0000

Auth.js: getToken() throws an uncaught exception on malformed Bearer authorization headers

pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)

Thu, 23 Jul 2026 00:00:00 +0000

pypdf: Possible infinite loop for not terminated inline images (ASCII85 and ASCIIHex filter)

pypdf: Possible infinite loop for not terminated inline images

Thu, 23 Jul 2026 00:00:00 +0000

pypdf: Possible infinite loop for not terminated inline images

VU#360868: Analog Way Picturall Quad Compact Mark II contains a local privilege escalation vulnerability

Wed, 22 Jul 2026 00:00:00 +0000

Overview Version 3.5.8 of Analog Way's Picturall Quad Compact Mark II server contains a local privilege escalation vulnerability, tracked as CVE-2026-14985, due to improper privilege delegation and insufficient input validation in a maintenance script. Description The Picturall Quad Compact Mark II is a compact, heavy-duty 8K media server developed by Analog Way for video playback and content management in professional audiovisual environments. The core firmware includes a maintenance script called create_local_installer.sh , and the default script permission allows the low-privileged user, picmedia , to execute it as root and without a password. An attacker creates a malicious Ext4 disk image that contains the file, picturall-version.txt , with a directory traversal string and a payload file. create_local_installer.sh reads input from... Related CVEs: CVE-2026-14985.

Check Point SmartConsole Improper Authentication Vulnerability

Wed, 22 Jul 2026 00:00:00 +0000

Check Point SmartConsole contains an improper authentication vulnerability which could allow an unauthenticated remote attacker to obtain an application login token and use it to authenticate with full administrative privileges.

VU#847406: Duplicati backup software v2.3.0.1 is vulnerable to an incorrect permission assignment vulnerability

Wed, 22 Jul 2026 00:00:00 +0000

Overview Duplicati v2.3.0.1 is vulnerable to arbitrary code execution when installed outside the default C:\Program Files\Duplicati 2\ directory. An attacker with local user privileges who can write files to the Duplicati installation directory can execute arbitrary code by placing malicious files, such as DLLs, in that directory. To mitigate this vulnerability, install Duplicati in the default C:\Program Files\ directory or update to the latest fixed version. Description Duplicati is a free, open-source backup solution that stores data across cloud and local storage platforms. On Windows, Duplicati is distributed as an MSI installer. By default, the installer deploys the application to C:\Program Files\Duplicati 2\ , where the directory inherits the standard protected ACLs provided by Windows. The following vulnerability affects... Related CVEs: CVE-2026-16157.

Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests

Wed, 22 Jul 2026 00:00:00 +0000

Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests

Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution

Wed, 22 Jul 2026 00:00:00 +0000

Eclipse Jetty Digest Authentication: ISO-8859-1 lossy encoding allows authentication bypass via character substitution

Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Wed, 22 Jul 2026 00:00:00 +0000

Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.

Nlnetlabs Unbound — CVE-2026-50252 (Critical)

Wed, 22 Jul 2026 00:00:00 +0000

In NLnet Labs Unbound 1.4.22 up to and including 1.25.1, UDP source port is randomized and intended to serve as a secret value that increases the entropy of DNS transactions. When resolver load balancing policies depend on the source port while their outcome is revealed this secrecy is undermined. The vulnerability arises when the load balancing policy is consistent with respect to the incoming source UDP port and IP address while heavily depending on the incoming source UDP port as a randomization source. When the SO_REUSEPORT configuration option is enabled ('so-reuseport: yes') in Unbound (

Next.js: Denial of Service in App Router using Server Actions

Wed, 22 Jul 2026 00:00:00 +0000

Next.js: Denial of Service in App Router using Server Actions

Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Wed, 22 Jul 2026 00:00:00 +0000

Next.js: Middleware / Proxy bypass in App Router applications using Turbopack and single locale

Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Wed, 22 Jul 2026 00:00:00 +0000

Next.js: Server-Side Request Forgery in rewrites via attacker-controlled destination hostname

Next.js: Server-Side Request Forgery in Server Actions on custom servers

Wed, 22 Jul 2026 00:00:00 +0000

Next.js: Server-Side Request Forgery in Server Actions on custom servers

n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner

Wed, 22 Jul 2026 00:00:00 +0000

n8n: SSO Instance-Role Provisioning Allows Privilege Escalation to Instance Owner

n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion

Wed, 22 Jul 2026 00:00:00 +0000

n8n: Send Email Node Arbitrary File Read and SSRF via Nodemailer Content-Object Type Confusion

n8n: Bypass "Allowed HTTP Request Domains" Credential Restriction in Multiple AI and LLM Nodes

Wed, 22 Jul 2026 00:00:00 +0000

n8n: Bypass "Allowed HTTP Request Domains" Credential Restriction in Multiple AI and LLM Nodes

n8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType`

Wed, 22 Jul 2026 00:00:00 +0000

n8n: Credential Authorization Bypass via Expression in HTTP Request Node `genericAuthType`

n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login

Wed, 22 Jul 2026 00:00:00 +0000

n8n: Account Takeover via Unverified Email Claim in Token Exchange Embed Login

n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON

Wed, 22 Jul 2026 00:00:00 +0000

n8n: Shared-Workflow Editor Can Exfiltrate Credentials via Inline Sub-Workflow JSON

n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction

Wed, 22 Jul 2026 00:00:00 +0000

n8n: Git Node fetch/pull/pushTags Operations Bypass Sandbox Path Restriction

n8n: Expression sandbox escape via arrow-function bodies enabling command execution

Wed, 22 Jul 2026 00:00:00 +0000

n8n: Expression sandbox escape via arrow-function bodies enabling command execution

n8n: Authenticated code execution in the n8n Git node

Wed, 22 Jul 2026 00:00:00 +0000

n8n: Authenticated code execution in the n8n Git node

n8n: Edit Image Node Format Injection Allows Arbitrary File Write

Wed, 22 Jul 2026 00:00:00 +0000

n8n: Edit Image Node Format Injection Allows Arbitrary File Write

n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service

Wed, 22 Jul 2026 00:00:00 +0000

n8n: Prototype Pollution via Dot-Notation Field Names Leads To Instance-Wide Denial of Service

LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

Wed, 22 Jul 2026 00:00:00 +0000

LiteLLM: MCP Authentication Bypass via OAuth2 Passthrough Fallback

JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

Wed, 22 Jul 2026 00:00:00 +0000

JupyterLab: Image viewer allows XSS when opening malicious image in new browser tab

JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)

Wed, 22 Jul 2026 00:00:00 +0000

JupyterLab: Cross-site scripting (XSS) via crafted settings file (`overrides.json`)

DD-WRT Stack-Based Buffer Overflow Vulnerability

Tue, 21 Jul 2026 00:00:00 +0000

DD-WRT contains a stack-based buffer overflow vulnerability that could allow an unauthenticated attacker to overflow an internal buffer used by UPnP and trigger a code execution vulnerability.

Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface

Tue, 21 Jul 2026 00:00:00 +0000

Gitea: TOTP TOCTOU race on web 2FA paths + missing replay check on Basic-Auth `X-Gitea-OTP` surface

Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUT...

Tue, 21 Jul 2026 00:00:00 +0000

Gitea Docker image: `REVERSE_PROXY_TRUSTED_PROXIES = *` default lets any source IP impersonate any user via `X-WEBAUTH-USER`

Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter

Tue, 21 Jul 2026 00:00:00 +0000

Gitea: Incomplete SSRF Protection in Webhook and Migration Allow-list Default Filter

Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private

Tue, 21 Jul 2026 00:00:00 +0000

Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private

Gitea: Unauthorized Access to Labels of Private Organizations

Tue, 21 Jul 2026 00:00:00 +0000

Gitea: Unauthorized Access to Labels of Private Organizations

Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write

Tue, 21 Jul 2026 00:00:00 +0000

Gitea: Cached Per-Branch Permission Check in Pre-Receive Hook Allows Full Repository Write

Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override

Tue, 21 Jul 2026 00:00:00 +0000

Gitea: Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override

Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomp...

Tue, 21 Jul 2026 00:00:00 +0000

Gitea: OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)

Gitea Remember-Me Token Theft Not Invalidating Attacker Session

Tue, 21 Jul 2026 00:00:00 +0000

Gitea Remember-Me Token Theft Not Invalidating Attacker Session

Gitea: Two SSRF findings

Tue, 21 Jul 2026 00:00:00 +0000

Gitea: Two SSRF findings

Gitea: Notification API leaks private issue metadata after access revocation

Tue, 21 Jul 2026 00:00:00 +0000

Gitea: Notification API leaks private issue metadata after access revocation

Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

Tue, 21 Jul 2026 00:00:00 +0000

Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service

Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Tue, 21 Jul 2026 00:00:00 +0000

Gitea: Improper authorization on OAuth sign-in callback silently re-enables administrator-disabled accounts

Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

Tue, 21 Jul 2026 00:00:00 +0000

Gitea: LFS authentication bypass via malformed SSH sub-verb allows unauthorized read access to private repositories

Gitea: Permanent Fork PR Workflow Approval Gate Bypass

Tue, 21 Jul 2026 00:00:00 +0000

Gitea: Permanent Fork PR Workflow Approval Gate Bypass

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-stat...

Tue, 21 Jul 2026 00:00:00 +0000

Gitea Actions Artifacts V4 signed URL HMAC ambiguity allows cross-repository artifact read and cross-task upload-state write

Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

Tue, 21 Jul 2026 00:00:00 +0000

Gitea: ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requests

Gitea: Repository Visibility Manipulation via Git Push Options

Tue, 21 Jul 2026 00:00:00 +0000

Gitea: Repository Visibility Manipulation via Git Push Options

Gitea: Public-only repository tokens can update private PR head branches

Tue, 21 Jul 2026 00:00:00 +0000

Gitea: Public-only repository tokens can update private PR head branches

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

Tue, 21 Jul 2026 00:00:00 +0000

gRPC-Go: xDS RBAC and HTTP/2 Vulnerabilities

Langflow Inclusion of Functionality from Untrusted Control Sphere Vulnerability

Tue, 21 Jul 2026 00:00:00 +0000

Langflow contains an inclusion of functionality from untrusted control sphere vulnerability that allows remote attackers to execute arbitrary code on affected installations.

Linknat VOS3000 and VOS2009 — CVE-2016-20096 (Critical)

Tue, 21 Jul 2026 00:00:00 +0000

Linknat VOS3000 and VOS2009 through version 2.1.2.0 contain an unauthenticated SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands by manipulating the name parameter in a POST request to the login endpoint. Attackers can inject malicious SQL through the login form and retrieve injected query results from a subsequent session request, enabling extraction of plaintext credentials and other database content with DBA-level privileges.

jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-5...

Tue, 21 Jul 2026 00:00:00 +0000

jackson-core: Async parser maxNumberLength bypass via chunked digit accumulation (incomplete fix for GHSA-72hv-8253-57qq)

fast-uri vulnerable to host confusion via literal backslash authority delimiter

Tue, 21 Jul 2026 00:00:00 +0000

fast-uri vulnerable to host confusion via literal backslash authority delimiter

Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry

Tue, 21 Jul 2026 00:00:00 +0000

Credential confusion in @sigstore/oci can leak registry credentials to an attacker-controlled registry

fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

Tue, 21 Jul 2026 00:00:00 +0000

fast-xml-parser: Repeated DOCTYPE declarations reset entity expansion limits

sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591

Tue, 21 Jul 2026 00:00:00 +0000

sharp inherited vulnerabilities in libvips: CVE-2026-33327, CVE-2026-33328, CVE-2026-35590, CVE-2026-35591

@vitest/browser: Browser Mode provider commands bypass the file-access permission gate

Tue, 21 Jul 2026 00:00:00 +0000

@vitest/browser: Browser Mode provider commands bypass the file-access permission gate

VU#762226: Plane contains multi-tenant authorization bypass vulnerability

Tue, 21 Jul 2026 00:00:00 +0000

Overview The project management tool Plane, versions 1.3.0 and earlier, contains a multi-tenant authorization bypass vulnerability in its asset-management API that allows unauthorized users to access, delete, or duplicate assets that belong to other workspaces. Description Plane is an open-source project management platform that provides multi-tenant workspace isolation for users to track issues, monitor progress, and manage workflows. The platform's API supports uploading, retrieving, deleting, and duplicating files associated with issues and tasks within a workspace. CVE-2026-15342 Plane's asset-management API endpoints accept workspace slugs and asset identifiers as path parameters, but do not verify that the requesting user is authorized to access the specified workspace. As a result, an authenticated user in one workspace can supply... Related CVEs: CVE-2026-15342.

GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

Tue, 21 Jul 2026 00:00:00 +0000

GitPython: Environment-variable exfiltration via os.path.expandvars() on Repo.clone_from() URL

WordPress Core SQL Injection Vulnerability

Tue, 21 Jul 2026 00:00:00 +0000

WordPress Core contains a SQL injection vulnerability when a plugin or theme passes untrusted input to the parameter. This vulnerability can be chained with CVE-2026-63030 to allow an unauthenticated attacker to gain remote code execution on default WordPress installations.

WordPress Core Interpretation Conflict Vulnerability

Tue, 21 Jul 2026 00:00:00 +0000

WordPress Core contains an interpretation conflict vulnerability that could allow an attacker to perform SQL Injection and achieve Remote Code Execution. This vulnerability can be chained with CVE-2026-60137.

Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim

Mon, 20 Jul 2026 00:00:00 +0000

Cloudreve: OAuth access tokens bypass scope enforcement due to missing client_id claim

File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failu...

Mon, 20 Jul 2026 00:00:00 +0000

File Browser: Out-of-scope file deletion by a Create-only scoped user via symlink-following RemoveAll in upload failure-cleanup

File Browser: Colliding username normalization gives two users the same home directory

Mon, 20 Jul 2026 00:00:00 +0000

File Browser: Colliding username normalization gives two users the same home directory

Neutrinolabs Xrdp — CVE-2026-41521 (Critical)

Mon, 20 Jul 2026 00:00:00 +0000

xrdp is an open source RDP server. Versions 0.10.6 and prior contain an integer overflow vulnerability when processing screen update messages within the vnc-any connection mode. A malicious remote VNC server can send crafted image dimensions that cause an integer overflow during memory buffer size calculation, resulting in an undersized allocation. Subsequent processing of the incoming image data using the original oversized parameters leads to an out-of-bounds read. An unauthenticated remote attacker could exploit this flaw to disclose sensitive information from the heap memory or cause a den

shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)

Mon, 20 Jul 2026 00:00:00 +0000

shell-quote: Quadratic-complexity Denial of Service in `parse()` (CWE-407)

Socket.IO: Engine.IO Polling Transport Connection Exhaustion

Mon, 20 Jul 2026 00:00:00 +0000

Socket.IO: Engine.IO Polling Transport Connection Exhaustion

Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch

Mon, 20 Jul 2026 00:00:00 +0000

Astro: Authorization Bypass via Decode Iteration Limit and Rewrite Path Canonicalization Mismatch

js-yaml: YAML merge-key chains can force quadratic CPU consumption

Mon, 20 Jul 2026 00:00:00 +0000

js-yaml: YAML merge-key chains can force quadratic CPU consumption

node-tar: Negative tar entry size causes infinite loop in archive replace

Mon, 20 Jul 2026 00:00:00 +0000

node-tar: Negative tar entry size causes infinite loop in archive replace

Directus: SSRF Protection Bypass via 0.0.0.0 in File Import

Mon, 20 Jul 2026 00:00:00 +0000

Directus: SSRF Protection Bypass via 0.0.0.0 in File Import

Directus: Authorization-dependent response served from unsegmented cache key

Mon, 20 Jul 2026 00:00:00 +0000

Directus: Authorization-dependent response served from unsegmented cache key

Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning

Mon, 20 Jul 2026 00:00:00 +0000

Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning

Microsoft Security Advisory CVE-2026-47302 – .NET Denial of Service Vulnerability

Mon, 20 Jul 2026 00:00:00 +0000

Microsoft Security Advisory CVE-2026-47302 – .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability

Mon, 20 Jul 2026 00:00:00 +0000

Microsoft Security Advisory CVE-2026-47304 – .NET Security Feature Bypass Vulnerability

Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability

Mon, 20 Jul 2026 00:00:00 +0000

Microsoft Security Advisory CVE-2026-50524 – .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-50525 – .NET Denial of Service Vulnerability

Mon, 20 Jul 2026 00:00:00 +0000

Microsoft Security Advisory CVE-2026-50525 – .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-50528 – .NET Security Feature Bypass Vulnerability

Mon, 20 Jul 2026 00:00:00 +0000

Microsoft Security Advisory CVE-2026-50528 – .NET Security Feature Bypass Vulnerability

Microsoft Security Advisory CVE-2026-50648 – .NET Denial of Service Vulnerability

Mon, 20 Jul 2026 00:00:00 +0000

Microsoft Security Advisory CVE-2026-50648 – .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability

Mon, 20 Jul 2026 00:00:00 +0000

Microsoft Security Advisory CVE-2026-50651 – .NET Denial of Service Vulnerability

Microsoft Security Advisory CVE-2026-57108 – .NET Denial of Service Vulnerability

Mon, 20 Jul 2026 00:00:00 +0000

Microsoft Security Advisory CVE-2026-57108 – .NET Denial of Service Vulnerability

Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`

Mon, 20 Jul 2026 00:00:00 +0000

Pillow: Heap out-of-bounds write in `ImageFilter.RankFilter` via integer overflow in `ImagingExpand`

Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow

Mon, 20 Jul 2026 00:00:00 +0000

Pillow: Heap out-of-bounds write `Image.paste()` / `Image.crop()` via signed coordinate overflow

Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()

Mon, 20 Jul 2026 00:00:00 +0000

Pillow: Decompression Bomb DoS via PdfParser.PdfStream.decode()

Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service

Mon, 20 Jul 2026 00:00:00 +0000

Pillow JPEG2000 tiled decode retains a growing scratch buffer and can be used for denial of service

Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch

Mon, 20 Jul 2026 00:00:00 +0000

Pillow: Controlled heap out-of-bounds write in Pillow `ImageCmsTransform.apply()` via output mode mismatch

Mistune plugins/formatting: quadratic-time parsing on long runs of `x`, `==x==`, and `^^x^^` markers (strikethrou...

Mon, 20 Jul 2026 00:00:00 +0000

Mistune plugins/formatting: quadratic-time parsing on long runs of `~~x~~`, `==x==`, and `^^x^^` markers (strikethrough / mark / insert)

Mistune inline_parser: quadratic-time parsing on long runs of `x` and `x` emphasis pairs

Mon, 20 Jul 2026 00:00:00 +0000

Mistune inline_parser: quadratic-time parsing on long runs of `**x**` and `***x***` emphasis pairs

Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions

Mon, 20 Jul 2026 00:00:00 +0000

Mistune block_parser: quadratic-time parsing on long lists of repeated reference-link definitions

LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests

Mon, 20 Jul 2026 00:00:00 +0000

LightRAG: CORS Wildcard + Credentials Enables Any-Origin Credentialed Requests

LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTR...

Mon, 20 Jul 2026 00:00:00 +0000

LightRAG is Vulnerable to Authentication Bypass: hardcoded DEFAULT_TOKEN_SECRET and public /auth-status defeat LIGHTRAG_API_KEY protection

Gitea has insufficient permission checks for Composer package source links

Fri, 17 Jul 2026 00:00:00 +0000

Gitea has insufficient permission checks for Composer package source links

Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies

Fri, 17 Jul 2026 00:00:00 +0000

Skipper: Incomplete fix for CVE-2026-50197: an oversized body can bypass OPA deny-on-presence Rego policies

IBM Langflow OSS 1.0.0 — CVE-2026-9135 (Critical)

Fri, 17 Jul 2026 00:00:00 +0000

IBM Langflow OSS 1.0.0 through 1.10.0 Langflow versions up to 1.9.2 (commit 94981c443d4918517b9e8163d70fc598dc33a32d) contain a code injection vulnerability in the Policies component's ToolGuard integration that bypasses the allow_custom_components=false security control. The vulnerability exists because the validation mechanism only checks the main component source code in node_template["code"]["value"] but fails to validate dynamic CodeInput fields that store generated ToolGuard Python files. Attackers can embed malicious Python code in these unvalidated dynamic fields, which are persisted i

AWS-JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance

Fri, 17 Jul 2026 00:00:00 +0000

AWS-JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance

Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader

Fri, 17 Jul 2026 00:00:00 +0000

Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader

CloudTAK: Authenticated full-read SSRF in the /api/esri* routes — user-controlled URL fetched with no IP-classificati...

Fri, 17 Jul 2026 00:00:00 +0000

CloudTAK: Authenticated full-read SSRF in the /api/esri* routes — user-controlled URL fetched with no IP-classification guard

Prompty: Arbitrary file read via file reference expansion

Fri, 17 Jul 2026 00:00:00 +0000

Prompty: Arbitrary file read via file reference expansion

vLLM has Remote DoS via Invalid Recovered Token Reinjection

Fri, 17 Jul 2026 00:00:00 +0000

vLLM has Remote DoS via Invalid Recovered Token Reinjection

meta-ads-mcp: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token

Fri, 17 Jul 2026 00:00:00 +0000

meta-ads-mcp: X-Pipeboard-Token Header Auth Bypass Reuses Operator Meta Token

meta-ads-mcp: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch

Fri, 17 Jul 2026 00:00:00 +0000

meta-ads-mcp: Server-Side Request Forgery (SSRF) in `upload_ad_image` via Unrestricted `image_url` Fetch

sh _uid does not drop supplementary groups (incomplete privilege drop)

Fri, 17 Jul 2026 00:00:00 +0000

sh _uid does not drop supplementary groups (incomplete privilege drop)

Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant ...

Fri, 17 Jul 2026 00:00:00 +0000

Flask-Reuploaded: Extension-denylist bypass via case-folding asymmetry in name-override path (incomplete-fix variant of CVE-2026-27641)

vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends

Fri, 17 Jul 2026 00:00:00 +0000

vLLM: ReDoS via structured_outputs.regex compiled without timeout in xgrammar and outlines backends

Pheditor has an authenticated terminal command whitelist bypass

Thu, 16 Jul 2026 00:00:00 +0000

Pheditor has an authenticated terminal command whitelist bypass

Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, an...

Thu, 16 Jul 2026 00:00:00 +0000

Pheditor: Incomplete command sanitization in terminal feature allows RCE via pipe operator, backtick substitution, and newline injection

Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise

Thu, 16 Jul 2026 00:00:00 +0000

Pheditor: Hardcoded default password 'admin' with no forced change enables full application compromise

Fortinet FortiSandbox OS Command Injection Vulnerability

Thu, 16 Jul 2026 00:00:00 +0000

Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.

Fortinet FortiSandbox OS Command Injection Vulnerability

Thu, 16 Jul 2026 00:00:00 +0000

Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.

Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE

Thu, 16 Jul 2026 00:00:00 +0000

Nuclio: Unsanitized runtimeAttributes.repositories injected into Groovy build.gradle leads to build-time RCE

Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure

Thu, 16 Jul 2026 00:00:00 +0000

Envoy Gateway: Authentication Bypass via Improper Input Validation in EnvoyExtensionPolicy Lua Allows Secret Disclosure

Envoy Gateway: xDS Control Plane Information Disclosure when operating in GatewayNamespaceMode

Thu, 16 Jul 2026 00:00:00 +0000

Envoy Gateway: xDS Control Plane Information Disclosure when operating in GatewayNamespaceMode

Hcltech Dfxanalytics — CVE-2026-56453 (Critical)

Thu, 16 Jul 2026 00:00:00 +0000

HCL DFXAnalytics is affected by an Account Takeover via Response Manipulation vulnerability. A remote attacker can intercept and alter the contents of the server's HTTP responses before they reach the client application, allowing them to manipulate the authentication or authorization logic to bypass controls and gain unauthorized access to targeted user accounts.

VU#885548: Denial-of-service vulnerability in HTTP/2 servers via stalled flow-control conditions

Thu, 16 Jul 2026 00:00:00 +0000

Overview A denial-of-service (DoS) vulnerability exists in some HTTP/2 server implementations that fail to adequately limit resource consumption when buffering response data under stalled flow-control conditions. A remote, unauthenticated attacker can trigger memory exhaustion and service interruption by using standard flow-control parameters such as SETTINGS_INITIAL_WINDOW_SIZE = 0 to stall outbound data for multiple simultaneous request streams. Description HTTP/2 is a widely used application-layer protocol that supports multiplexing, header compression, and flow-control mechanisms to regulate the transmission of data between web browsers and servers. Flow control is designed to prevent senders from overwhelming receivers and relies on client-advertised window sizes to determine the maximum volume of unacknowledged data that can be in...

ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)

Thu, 16 Jul 2026 00:00:00 +0000

ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)

ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users

Thu, 16 Jul 2026 00:00:00 +0000

ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users

ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read

Thu, 16 Jul 2026 00:00:00 +0000

ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read

ArcadeDB: Scripting authorization gate (GHSA-48qw-824m-86pr) bypassed via SQL DEFINE FUNCTION ... LANGUAGE js

Thu, 16 Jul 2026 00:00:00 +0000

ArcadeDB: Scripting authorization gate (GHSA-48qw-824m-86pr) bypassed via SQL DEFINE FUNCTION ... LANGUAGE js

ArcadeDB has cross-database IDOR: /ts/, /batch/, Prometheus and Grafana handlers bypass authorization

Thu, 16 Jul 2026 00:00:00 +0000

ArcadeDB has cross-database IDOR: /ts/*, /batch/*, Prometheus and Grafana handlers bypass authorization

ArcadeDB: Trigger scripts run with java.lang.* allowed, enabling OS command execution (RCE)

Thu, 16 Jul 2026 00:00:00 +0000

ArcadeDB: Trigger scripts run with java.lang.* allowed, enabling OS command execution (RCE)

MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal

Thu, 16 Jul 2026 00:00:00 +0000

MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal

MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks

Thu, 16 Jul 2026 00:00:00 +0000

MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks

MCP Python SDK: WebSocket server transport does not support Host/Origin validation

Thu, 16 Jul 2026 00:00:00 +0000

MCP Python SDK: WebSocket server transport does not support Host/Origin validation

VU#326070: SGLang contains a vulnerable pickle deserialization vulnerability through the expert-parallel subsystem

Thu, 16 Jul 2026 00:00:00 +0000

Overview A Pickle deserialization vulnerability has been discovered within the SGLang project , enabling an attacker to perform remote code execution (RCE) on the target vulnerable server. In order for an attacker to exploit this vulnerability, the expert-parallel backup subsystem must be enabled, and an attacker must have network access to the SGLang service. No patch is available at this time, and no response was obtained from the project maintainers during coordination. Description SGLang is an open-source framework for serving large language models (LLMs) and multimodal AI models, supporting models such as Qwen, DeepSeek, Mistral, and Skywork, and is compatible with OpenAI APIs. A vulnerability has been discovered within the tool and is tracked as follows: CVE-2026-14890 SGLang uses an expert-parallel backup subsystem designed to... Related CVEs: CVE-2026-14890, CVE-2026-7301, CVE-2026-7304.

Spaceapplications Yamcs — CVE-2026-44596 (Critical)

Thu, 16 Jul 2026 00:00:00 +0000

Yamcs is a mission control framework. Prior to 5.12.7, the authentication endpoint POST /auth/token in yamcs-core, handled by yamcs-core/src/main/java/org/yamcs/http/auth/AuthHandler.java, lacked any rate limiting, account lockout, or failed-attempt throttling, so an unauthenticated remote attacker could perform unlimited password-guessing attempts against any user account, significantly increasing the risk of successful brute-force attacks. This issue is fixed in versions 5.12.7 and 5.13.0.

MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator

Wed, 15 Jul 2026 00:00:00 +0000

MantisBT: SOAP API Authentication Bypass with Privilege Escalation to Administrator

MantisBT: Reflected XSS in admin/install.php

Wed, 15 Jul 2026 00:00:00 +0000

MantisBT: Reflected XSS in admin/install.php

MantisBT: Reflected XSS in admin/install.php via unescaped printf

Wed, 15 Jul 2026 00:00:00 +0000

MantisBT: Reflected XSS in admin/install.php via unescaped printf

Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths

Wed, 15 Jul 2026 00:00:00 +0000

Koel: Incomplete fix for CVE-2026-47260 — systemic SSRF in podcast & radio fetch paths

MantisBT: Stored XSS in print_all_bug_page_word.php

Wed, 15 Jul 2026 00:00:00 +0000

MantisBT: Stored XSS in print_all_bug_page_word.php

Protobuf: Unbounded recursion depth in embedded-message decoding

Wed, 15 Jul 2026 00:00:00 +0000

Protobuf: Unbounded recursion depth in embedded-message decoding

dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS

Wed, 15 Jul 2026 00:00:00 +0000

dd-trace-go: Improper parsing of W3C baggage headers may lead to DoS

Pomerium Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback

Wed, 15 Jul 2026 00:00:00 +0000

Pomerium Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback

KNX Association KNX Protocol Connection Authorization Option 1 Overly Restrictive Account Lockout Mechanism Vulnerabi...

Wed, 15 Jul 2026 00:00:00 +0000

KNX Association KNX Protocol Connection Authorization Option 1 contains an overly restrictive account lockout mechanism vulnerability that could allow an attacker to purge all devices without additional security options enabled and set a BCU key to lock the device.

dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS

Wed, 15 Jul 2026 00:00:00 +0000

dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS

dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS

Wed, 15 Jul 2026 00:00:00 +0000

dd-trace-js: Improper parsing of W3C baggage headers may lead to DoS

systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux

Wed, 15 Jul 2026 00:00:00 +0000

systeminformation: OS command injection in networkInterfaces() via interfaces(5) source-directive path on Linux

websocket-driver: Message corruption via abuse of protocol length headers

Wed, 15 Jul 2026 00:00:00 +0000

websocket-driver: Message corruption via abuse of protocol length headers

@andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default

Wed, 15 Jul 2026 00:00:00 +0000

@andrea9293/mcp-documentation-server: Web UI API binds to all interfaces without authentication by default

obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read...

Wed, 15 Jul 2026 00:00:00 +0000

obsidian-local-rest-api: Authenticated path traversal via URL-encoded %2F in /vault/{path} — arbitrary host file read/write/delete

dd-trace-dotnet: Improper parsing of W3C baggage headers may lead to DoS

Wed, 15 Jul 2026 00:00:00 +0000

dd-trace-dotnet: Improper parsing of W3C baggage headers may lead to DoS

Openwebui Open Webui — CVE-2026-56398 (Critical)

Wed, 15 Jul 2026 00:00:00 +0000

Open WebUI before 0.9.5 contains a stored cross-site scripting vulnerability in the OAuth authentication flow where the picture claim URL MIME type is inferred from file extension rather than Content-Type header, allowing SVG files to bypass the profile image validator and be stored as data URIs. Authenticated users who visit the profile image endpoint receive attacker-controlled SVG content with inline disposition and no default security headers, enabling script execution in the same origin to steal authentication tokens and achieve account takeover.

Openwebui Open Webui — CVE-2026-56400 (Critical)

Wed, 15 Jul 2026 00:00:00 +0000

open-webui before 0.3.14 contains a cross-origin resource sharing misconfiguration allowing arbitrary origins with allow_origins=* and authenticated requests to the /api/v1/functions endpoint. Attackers can execute arbitrary code on the openwebui instance by crafting malicious cross-site requests from attacker-controlled websites when an admin user visits them.

Oracle E-Business Suite Improper Privilege Management Vulnerability

Wed, 15 Jul 2026 00:00:00 +0000

Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability can result in takeover of Oracle Payments.

VU#529388: Privilege escalation vulnerability via unprotected IOCTL interface in Pegatron Tdelo64.sys

Wed, 15 Jul 2026 00:00:00 +0000

Overview A privilege escalation vulnerability exists in the tdeio64.sys driver due to an unprotected input/output control (IOCTL) dispatch routine that fails to validate the origin and permissions of user-supplied requests. An unprivileged local attacker can abuse exposed IOCTL dispatch routines [RM1.1][MB1.2]to perform arbitrary kernel memory read and write operations, ultimately obtaining NT AUTHORITY\SYSTEM privileges and compromising the security of the affected system. Description The tdeio64.sys driver distributed by Pegatron Corporation, a Taiwanese electronics manufacturer that produces motherboards and OEM components, is a Windows Driver Model (WDM) driver that provides low-level access to system I/O ports and hardware components. The driver exposes the \\.\TdeIo device interface and processes privileged IOTL requests without... Related CVEs: CVE-2026-14960, CVE-2026-14961.

dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS

Wed, 15 Jul 2026 00:00:00 +0000

dd-trace-py: Improper parsing of W3C baggage headers may lead to DoS

LangBot: Authenticated RCE Via MCP Configuration

Wed, 15 Jul 2026 00:00:00 +0000

LangBot: Authenticated RCE Via MCP Configuration

TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endpoint

Wed, 15 Jul 2026 00:00:00 +0000

TensorZero Gateway: Arbitrary file read and SSRF in internal object storage endpoint

django-haystack: Remote Code Execution via `eval()` in Elasticsearch Result Deserialization

Wed, 15 Jul 2026 00:00:00 +0000

django-haystack: Remote Code Execution via `eval()` in Elasticsearch Result Deserialization

VU#725167: node-forge Signature Forgery Vulnerabilities in RSA-PKCS and ED25519 Implementations

Wed, 15 Jul 2026 00:00:00 +0000

Overview Two distinct cryptographic signature verification vulnerabilities exist in Digital Bazaar node-forge, a widely used JavaScript library implementing cryptographic primitives for Node.js and browser environments. These vulnerabilities allow attackers to forge RSA (PKCS#1 v1.5) and Ed25519 signatures under specific, exploitable conditions. Description Both vulnerabilities stem from insufficient enforcement of canonical cryptographic structures during verification: in the RSA case, non-standard ASN.1 encodings and undersized padding are accepted; in the Ed25519 case, non-canonical signature scalars are not rejected. As a result, node-forge accepts signatures that appear valid internally but are rejected by industry-standard libraries such as OpenSSL and Node.js’s native crypto module. The vulnerabilities affect node-forge versions... Related CVEs: CVE-2026-33894, CVE-2026-33895.

dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS

Wed, 15 Jul 2026 00:00:00 +0000

dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS

ViewComponent: around_render HTML-Safety Bypass

Wed, 15 Jul 2026 00:00:00 +0000

ViewComponent: around_render HTML-Safety Bypass

Adobe Commerce — CVE-2026-47984 (Critical)