cve
Vulnerability watch Full archive
idvulnerabilityseveritypublished
CVE-2026-18193IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote attacker to bypass security restrictions due to improper validation of user-controlled addresses.Ibm I High CVSS 8.9 CVE-2026-18249IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to gain elevated privileges due to improper validation of pointers read from Java-controlled addresses.Ibm I High CVSS 8.4 CVE-2026-18408Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \restrict and \unrestrict to block this attack, but \unrestrict itself was sufficient for an attack. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. Non-core use of \restrict would be affected, but we've not identified non-core use. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.Postgresql High CVSS 8.8 CVE-2026-18428A SQL query validation bypass in the Flint extension query handler in the OpenSearch SQL plugin allows a remote authenticated actor with async query access to execute arbitrary code on Apache Spark workers by sending a crafted SQL query to the direct query endpoint.NVD analysis in progress High CVSS 8.8 CVE-2026-18509IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to gain privilege escalation via the Navigator for i debugger. This could allow the attacker to access or manipulate sensitive data on the system, or create new profiles with elevated privileges on the IBM i system.Ibm I High CVSS 7.1 CVE-2026-18511IBM i 7.6, 7.5, 7.4, and 7.3 could allow a local authenticated attacker to generate a stack-based buffer overflow in the Native IBM i JSSE provider, caused by improper bounds checking during TLS session establishment. A local attacker could overflow a fixed-length buffer and execute arbitrary code on the system or cause the JVM process to crash.Ibm I High CVSS 7.8 CVE-2026-18846IBM i 7.6, 7.5, 7.4, and 7.3 s vulnerable to a buffer overflow from improperly validating client data. By sending malformed requests to one of the host servers, a remote attacker could leverage this vulnerability to cause a denial-of-server (DoS) for that server.Ibm I High CVSS 7.5 CVE-2026-18945The WP Helper Premium WordPress plugin before 4.7.6 does not verify the order key when rendering its custom order confirmation page or when handling the related AJAX actions, allowing unauthenticated users to view other customers' order details, including personal information, as well as change the state of arbitrary orders.
Exploitation requires WooCommerce to be active and the WP Helper Premium WordPress plugin before 4.7.6's optional order confirmation page module to be enabled.NVD analysis in progress High CVSS 8.2 CVE-2026-19291Bluetooth re-pairing with an existing device can use a lower security level. RS9116W and SiWx91x impacted. See V3 in the BLERP paper linked below.NVD analysis in progress High CVSS 8.8 CVE-2026-19292Re-pairing with a legitimate device can use a lower security level than
previous making brute-forcing the LTK easier. See V4 in the BLERP paper linked below.NVD analysis in progress High CVSS 8.8 CVE-2026-19293SMP security request (from peripheral) does not include the maximum
encryption key size supported. Using a key with less than the maximum keysize
makes brute-forcing the key easier. See V6 in BLERP paper linked below.NVD analysis in progress High CVSS 8.8 CVE-2026-19297IBM Langflow OSS 1.0.0 through 1.9.6 could allow a remote attacker to obtain unauthorized access to user accounts due to improper restriction of excessive authentication attempts.Langflow Critical CVSS 9.1 CVE-2026-19385Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.Postgresql High CVSS 8.8 CVE-2026-19481@fastify/busboy is a multipart form-data parser. In versions 1.0.0 through 3.2.0, an attacker who can submit multipart form-data can crash the parser by sending a part header whose name is a prototype-inherited property such as __proto__ or constructor. The internal header parser stores headers in a plain JavaScript object and assumes each value is an array, so an inherited property name resolves to a truthy non-array value and triggers a TypeError. In the common pipe integration the failure surfaces as an error event, but in direct write or end usage the exception is thrown synchronously and can terminate the Node.js process, causing an unauthenticated denial of service. The issue is fixed in @fastify/busboy 3.2.1, which creates the header object with a null prototype. Users should upgrade to 3.2.1.NVD analysis in progress High CVSS 7.5 CVE-2026-19484@fastify/busboy is a multipart form-data parser. In versions 3.1.0 through 3.2.0, a remote unauthenticated attacker can stall the Node.js event loop by sending a multipart request whose boundary is crafted to a specific length. The vendored streaming search stores its skip table in a fixed 256 entry byte array, and a boundary of exactly 252 bytes makes the search needle 256 bytes, which truncates the default skip distance to zero and turns the search into a CPU bound loop on a small body. A single small request can keep one core busy and deny service to other requests handled by the same process. The issue is fixed in @fastify/busboy 3.2.1, which widens the skip table so the skip distance is preserved. Users should upgrade to 3.2.1.NVD analysis in progress High CVSS 7.5 CVE-2026-19710A vulnerability was found in SourceCodester Simple Student Information System. Affected by this vulnerability is an unknown functionality of the file app/admin/departments/view_department.php. Performing a manipulation of the argument ID results in sql injection. The attack is possible to be carried out remotely. The exploit has been made public and could be used. High CVSS 7.3 CVE-2026-19734Missing Authorization and Authorization Bypass Through User-Controlled Key in the product management component in Roskus Prospero Flow CRM before 5.4.7 allows authenticated users of any company to read the full sensitive data (price, cost, stock, SKU, and barcode) of another company's product and to hijack that product by reassigning its company_id, via the product's numeric identifier, because `ProductUpdateController` did not extend `MainController` and therefore required no authentication check on the read endpoint, and `ProductRepository::save()` retrieved the record via `Product::find($data['id'])` without constraining the query to the authenticated user's company before overwriting its company_id.NVD analysis in progress High CVSS 8.6 CVE-2026-19747A weakness has been identified in Tenda CH7, CH7G, CH10, CP3, CP3 Pro, CP7, TC3B14C, TC3B15C, TC3T14C and TC3T15C up to 20260625. This impacts the function CAte::HandleCmd of the file Kylin of the component ATE Module. This manipulation causes command injection. The attack is possible to be carried out remotely. Critical CVSS 9.8 CVE-2026-19750A flaw has been found in Tenda CH, CP and TX3 V21.x/V22.x/V25.x/V26.x/V27.x. Affected by this issue is some unknown functionality of the component SSH. Executing a manipulation can lead to use of hard-coded password. It is possible to launch the attack remotely. The attack requires a high level of complexity. The exploitation is known to be difficult. The exploit has been published and may be used. High CVSS 8.1 CVE-2026-19753A vulnerability was detected in Model Context Protocol mcp-rdf-explorer 1.0.0. Affected is the function explore_url of the file src/mcp-rdf-explorer/server.py of the component MCP Server. Performing a manipulation of the argument url results in server-side request forgery. The attack may be initiated remotely. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way. High CVSS 7.3 CVE-2026-24791Public-only tokens bypass private-resource restrictions on `/api/v1/user` self routesNVD analysis in progress High CVSS 8.1 CVE-2026-27345Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions. High CVSS 7.5 CVE-2026-27380Editor PHP Object Injection in Car Rental Manager <= 1.3.9 versions. High CVSS 7.2 CVE-2026-27535Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions. High CVSS 7.1 CVE-2026-27536Unauthenticated Cross Site Scripting (XSS) in MailChimp Subscribe Forms <= 4.3.3 versions. High CVSS 7.1 CVE-2026-27538Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions. High CVSS 7.5 CVE-2026-27539Unauthenticated Cross Site Scripting (XSS) in Welcart e-Commerce <= 2.11.31 versions. High CVSS 7.1 CVE-2026-27543Unauthenticated Privilege Escalation in MStore API <= 4.20.0 versions. High CVSS 8.1 CVE-2026-27544Unauthenticated Remote Code Execution (RCE) in QA Analytics <= 5.2.0.0 versions. Critical CVSS 10 CVE-2026-28001Unauthenticated SQL Injection in WP Directory Kit <= 1.5.4 versions. Critical CVSS 9.3 CVE-2026-28002Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Arraytics Booktics allows Blind SQL Injection.
This issue affects Booktics: from n/a through 1.0.22. High CVSS 8.5 CVE-2026-28003Unauthenticated Cross Site Scripting (XSS) in Maspik – Spam blacklist <= 2.9.1 versions. High CVSS 7.1 CVE-2026-28004Unauthenticated Cross Site Scripting (XSS) in Business Directory <= 6.4.25 versions. High CVSS 7.1 CVE-2026-28008Unauthenticated Broken Authentication in OAuth Single Sign On – SSO (OAuth Client) <= 7.0.0 versions. Critical CVSS 9.8 CVE-2026-28142Unauthenticated SQL Injection in Web Directory Free <= 1.7.13 versions. Critical CVSS 9.3 CVE-2026-28148Unauthenticated Bypass Vulnerability in Headless Single Sign On <= 1.6 versions. Critical CVSS 9.8 CVE-2026-28149Unauthenticated PHP Object Injection in Headless Single Sign On <= 1.6 versions. Critical CVSS 9.8 CVE-2026-28154Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in snstheme Samex - Clean, Minimal Shop WooCommerce WordPress Theme and snstheme M.Anh - Fashion WooCoommerce WordPress Theme allows Reflected XSS.
This issue affects Samex - Clean, Minimal Shop WooCommerce WordPress Theme: from n/a through 2.5; M.Anh - Fashion WooCoommerce WordPress Theme: from n/a through 1.7. High CVSS 7.1 CVE-2026-28156Subscriber SQL Injection in Do Lasso <= 358 versions. High CVSS 8.5 CVE-2026-28157Subscriber Path Traversal in Do Lasso <= 358 versions. High CVSS 7.5 CVE-2026-28158Unauthenticated Cross Site Scripting (XSS) in Do Lasso <= 358 versions. High CVSS 7.1 CVE-2026-28161Subscriber Privilege Escalation in Service Finder Booking <= 6.2 versions. High CVSS 8.8 CVE-2026-28168Subscriber SQL Injection in CubeWP <= 1.1.30 versions. High CVSS 8.5 CVE-2026-28170Unauthenticated Cross Site Scripting (XSS) in Blog Floating Button <= 1.4.20 versions. High CVSS 7.1 CVE-2026-28173Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions. High CVSS 7.1 CVE-2026-28175Unauthenticated Cross Site Scripting (XSS) in Visitors Traffic Real Time Statistics <= 8.11 versions. High CVSS 7.1 CVE-2026-28176Unauthenticated PHP Object Injection in Booking Activities <= 1.18.4 versions. High CVSS 8.8 CVE-2026-28185Unauthenticated Broken Authentication in Log in with Google <= 1.4.2 versions. Critical CVSS 9.8 CVE-2026-28186Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions. High CVSS 8.1 CVE-2026-28187Unauthenticated Cross Site Scripting (XSS) in Knowledge Base for Documentation, FAQs with AI Assistance <= 17.211.0 versions. High CVSS 7.1 CVE-2026-28188Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions. High CVSS 7.3 CVE-2026-28189Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions. High CVSS 7.4 CVE-2026-33818Enforce a recursion limit in Unmarshal to prevent stack exhaustion when parsing deeply-nested, recursive structures.NVD analysis in progress High CVSS 7.5 CVE-2026-45725compliance-trestle is a tooling platform for managing compliance as code. Prior to versiions 3.12.2 and 4.0.3, the compliance-trestle library's remote fetching cache mechanism (HTTPSFetcher and SFTPFetcher) constructs the local cache file path from the URL path component without sanitizing path traversal sequences (`../`). When a remote OSCAL profile references a URL with traversal in its path, the HTTP response body is written to a location outside the intended cache directory, enabling arbitrary file write with attacker-controlled content to the filesystem. Versions 3.12.3 and 4.0.3 patch the issue.NVD analysis in progress High CVSS 7.1 CVE-2026-46382The Meeting Room Booking System (MRBS) is a PHP-based application for booking meeting rooms. Prior to version 1.12.2, a user-supplied private/local URI can be made to be fetched without checks. Version 1.12.2 contains a fix. No known workarounds are available.NVD analysis in progress High CVSS 8.7 CVE-2026-48099WsgiDAV is a generic and extendable WebDAV server based on WSGI. WsgiDAV 4.3.3 and prior can allow a WebDAV request path containing an encoded parent-directory segment to escape the configured filesystem share root in a specific path layout. The issue is fixed with version 4.3.4.NVD analysis in progress High CVSS 7.1 CVE-2026-48702Rekor is a software supply chain transparency log. Starting in version 0.3.0 and prior to version 1.5.2, the `Package.Unmarshal()` function in `pkg/types/alpine/apk.go` decompresses the signature and control gzip members of an APK file into in-memory buffers without bounding the total decompressed size. The existing `max_apk_metadata_size` check (default 1MB) is only applied to individual tar entry header sizes after decompression completes, so it does not prevent a decompression bomb from consuming unbounded heap memory. An attacker can craft a gzip stream that compresses at a ~1000:1 ratio (e.g., 2MB compressed zeros → 2GB decompressed). When submitted as spec.package.content in an Alpine `ProposedEntry`, the server decompresses the full payload into memory during request processing, triggering a fatal Go runtime out-of-memory error or OS OOM-kill that cannot be caught by the server's recover() middleware. This is reachable via two unauthenticated endpoints, `POST /api/v1/log/entries (createLogEntry)` and `POST /api/v1/log/entries/retrieve (searchLogQuery)`. Both invoke `V001Entry.Canonicalize()` → `fetchExternalEntities()` → `apk.Unmarshal(packageData)`, which performs the unbounded decompression. Version 1.5.2 patches the issue. There is no effective workaround. Setting `max_request_body_size` reduces but does not eliminate exposure due to the ~1000:1 compression ratio (a 1MB body limit still allows ~1GB heap allocation). Setting `max_apk_metadata_size` has no effect on this vulnerability since the check is applied after decompression.NVD analysis in progress High CVSS 7.5 CVE-2026-49473@cedar-policy/authorization-for-expressjs is an open-source Express.js middleware that integrates Cedar authorization into Express applications by mapping HTTP requests to Cedar actions and evaluating authorization policies before allowing requests to proceed. Versions prior to 0.3.0 have an issue where, under certain circumstances, the middleware matches incoming requests against Cedar action mappings using req.originalUrl, which includes the query string, while Express routes requests using only the path component. The middleware uses req.originalUrl to match incoming requests against Cedar action mappings. In Express, req.originalUrl includes the query string, while route matching uses only the path. This creates a divergence between what Cedar authorizes and what Express executes. When an application defines separate actions for overlapping path prefixes with different authorization requirements (for example, GET /users for listing all users with admin-only access, and GET /users/{id} for retrieving a single user with any authenticated user access), an actor can append a query string to bypass the more restrictive policy. Sending GET /users/?x=1 causes the middleware to match against /users/{id} (with id parameter set to ?x=1) and evaluate the less restrictive action, while Express routes the request to the /users list handler. This allows inappropriate access to the more restrictive endpoint. This issue has been addressed in version 0.30. Some workarounds are available. Validate and sanitize incoming request paths before they reach the authorization middleware. Ensure that applications do not rely solely on the middleware for authorization when defining multiple actions on overlapping path prefixes with different permission levels.NVD analysis in progress High CVSS 8.8 CVE-2026-49478Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions through 1.8.5 improperly follow cross-host redirects and attach Kubernetes ServiceAccount tokens during OIDC discovery, allowing a malicious or compromised issuer to perform blind SSRF, substitute and cache malicious JWKS keys, or disclose ServiceAccount tokens to external hosts. Version 1.8.6 blocks cross-host redirects, restricts token injection, and restricts local token loading. No known workarounds are available.NVD analysis in progress High CVSS 8.7 CVE-2026-49819UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in `pb.HandlerInitSuperuser` (`backend/pb/handlers.go:249`), reachable as `POST /api/upsnap/init-superuser`. The vulnerable code lacks any authentication, setup token, IP allow-list, or rate limit and is gated only by a `totalSuperusers > 0` count check — a condition that is false on every fresh install — allowing an unauthenticated network-adjacent attacker to register the initial superuser account, receive a long-lived JWT, and pivot to root remote code execution at `backend/networking/wake.go:43` (`exec.CommandContext(ctx, "/bin/sh", "-c", wake_cmd)`). Version 5.4.0 fixes the issue.NVD analysis in progress Critical CVSS 9.8 CVE-2026-49827WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files through the HR Expense scan_file parameter, leading to Remote Code Execution. Combined with open registration (no invite required) and broken role middleware (CheckUserRole silently swallows RouteNotFoundException), this chain is effectively unauthenticated RCE against any default installation. The issue is patched in commit 5c54862fa044b363fd2be03d586750e81afd6818.NVD analysis in progress Critical CVSS 9.8 CVE-2026-49857auth-fetch-mcp is an MCP server that lets AI assistants fetch content from authenticated web pages. Version 3.0.1 implements SSRF protection in `assertSafeUrl()` (`src/security.ts`) to block requests to private and loopback addresses. However, the `isPrivateV6()` function fails to detect IPv4-mapped IPv6 loopback addresses in their hex-normalized form. When an attacker supplies a URL such as `http://[::ffff:127.0.0.1]:PORT/`, the Node.js WHATWG URL parser silently normalizes the host to `[::ffff:7f00:1]`. Because `net.isIPv4('7f00:1')` returns `false`, the private-IP check is bypassed and the URL is passed to the browser or HTTP client, allowing the MCP tool to reach loopback services that are supposed to be blocked. The issue is exploitable under default configuration without any special environment variable. Version 3.0.1 patches the issue.NVD analysis in progress High CVSS 7.4 CVE-2026-49864wetty provides terminal access in browser over http/https. Prior to version 3.0.4, the wetty client decodes a base64 filename from the file-download escape sequence and interpolates it raw into a Toastify HTML string (`escapeMarkup: false`). Any output the victim renders - a `cat`'d file, a tailed log, an SSH MOTD, a `curl` response - that contains `\x1b[5i...:...\x1b[4i` runs script in the wetty origin and types attacker-chosen keystrokes into the victim's SSH session. Version 3.0.4 fixes the issue.NVD analysis in progress High CVSS 8.6 CVE-2026-53783rsync before 3.5.0 contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability in the rrsync restricted shell wrapper that allows authenticated clients to escape enforced directory restrictions by substituting a symlink for a path component after validation but before transfer processing. Attackers can additionally leverage unrestricted flags such as --copy-unsafe-links, -D, and --log-file through rrsync to read or write files outside the permitted directory subtree.NVD analysis in progress High CVSS 8.1 CVE-2026-53784rsync before 3.5.0 contains a path traversal vulnerability that allows remote clients to access files outside the intended module root when use chroot is disabled and the module root path or a component of it is a symlink. The daemon calls chdir() to the module root at session initialization without resolving symlinks via realpath() or equivalent, causing subsequent relative-path operations to reference files relative to the symlink target rather than the intended module root, enabling unauthorized file access.NVD analysis in progress High CVSS 7.1 CVE-2026-53785rsync before 3.5.0 contains a path traversal vulnerability that allows a malicious sender to write files outside the intended destination directory tree by crafting relative paths with symlink components in --relative mode. The make_path() function follows symlinks pointing outside the destination tree while creating intermediate directories without verifying that created paths remain within the destination boundary, enabling arbitrary file writes on the receiver's filesystem.NVD analysis in progress High CVSS 7.1 CVE-2026-53790rsync before 3.5.0 contains multiple command and argument injection vulnerabilities that allow attackers to execute arbitrary commands by supplying malicious input through several code paths, including the RSYNC_CONNECT_PROG environment variable, daemon hooks, the rsync-ssl wrapper, and remote-shell command newline injection. Attackers can inject shell metacharacters or newline characters into unsanitized user-supplied values such as hostnames and hostspecs to execute arbitrary commands under the privileges of the rsync process or the invoking user.NVD analysis in progress High CVSS 8.1 CVE-2026-53791rsync daemon before 3.5.0 contains an IP address spoofing vulnerability that allows unauthenticated remote attackers to bypass IP-based access controls by sending a crafted PROXY protocol header with a forged source address. Attackers who can connect directly to the rsync daemon can inject a spoofed source IP in the PROXY protocol header to circumvent hosts allow/deny rules, gaining unauthorized access that would otherwise be blocked based on their real source address.NVD analysis in progress Critical CVSS 9.1 CVE-2026-53793rsync before 3.5.0 contains a path confinement bypass vulnerability that allows remote clients to escape the intended inner-module root confinement by constructing paths that resolve outside the chroot boundary when the module root contains a /./ boundary marker. Attackers can exploit improper handling of the /./ notation or forge delta-basis transfers referencing xname paths that cross the /./ boundary to gain unauthorized read or write access to files outside the module's subtree.NVD analysis in progress High CVSS 7.4 CVE-2026-53795rsync before 3.5.0 contains an arbitrary file write vulnerability that allows attackers to write files outside the intended destination tree by specifying an absolute path via --temp-dir or --link-dest options. The rename-confinement logic is bypassed when these options resolve to paths outside the destination tree, enabling attacker-controlled values to write files to arbitrary locations accessible to the rsync process.NVD analysis in progress High CVSS 8.1 CVE-2026-53802rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a symlink at a predictable --files-from or --password-file path, or supply a --files-from path that escapes the daemon module root, to read arbitrary files accessible to the rsync process.NVD analysis in progress High CVSS 7.1 CVE-2026-53803rsync before 3.5.0 contains a symlink following vulnerability that allows local attackers to overwrite arbitrary files by placing a symlink at a predictable output path such as --log-file, --write-batch, or daemon-mode log and statistics paths. Attackers can exploit rsync's failure to reject symlinks during ancillary file writes to redirect output to arbitrary filesystem locations, achieving local privilege escalation on installations where rsync runs with elevated privileges such as setuid or privileged daemon configurations.NVD analysis in progress High CVSS 7.8 CVE-2026-54481Internal API HTTP client hardcodes InsecureSkipVerify:true with no config override (CWE-295)NVD analysis in progress High CVSS 7.5 CVE-2026-55402CVE-2026-55402 is an out of bounds read vulnerability in Secure Access
servers prior to version 14.57. Attackers with an ‘in the middle’
position can send specially crafted data to a server causing a
persistent denial of service.NVD analysis in progress High CVSS 8.7 CVE-2026-55982OIDC userinfo Endpoint Returns Identity Claims Without Enforcing API Token ScopesNVD analysis in progress Critical CVSS 9.1 CVE-2026-55987OAuth2 sign-in reactivates an administrator-deactivated account on auth sources without refresh tokens (incomplete fix of #38009)NVD analysis in progress High CVSS 8.1 CVE-2026-56443Token public-only scope bypassed on Limited-visibility owners (Repository + Package categories) — residual after CVE-2026-25714 / PR #37118NVD analysis in progress Critical CVSS 9.6 CVE-2026-56654Privilege Escalation via Access Token Scope Escalation in APINVD analysis in progress Critical CVSS 9.8 CVE-2026-56750Gitea Remember-Me Token Theft Not Invalidating Attacker SessionNVD analysis in progress Critical CVSS 9.1 CVE-2026-56853When a server is configured to support unencrypted HTTP/2, it reads a few bytes from each new connection to see if they contain the HTTP/2 client preface. ReadHeaderTimeout is unexpectedly not being applied when doing this.NVD analysis in progress High CVSS 7.5 CVE-2026-56859Previously, DecodeElement would reset the depth counter causing it to never fire; this could lead to stack exhaustion.NVD analysis in progress High CVSS 7.5 CVE-2026-56862Handshake messages, such as KeyUpdate, are always considered as state-advancing, regardless of whether a handshake has been completed or not. As a result, a malicious client can keep sending KeyUpdate messages to force the server to keep performing key derivation operations indefinitely.NVD analysis in progress High CVSS 7.5 CVE-2026-56864A malicious GOSUMDB was capable of serving arbitrary module content not contained within the transparency log. This attack allows for a coordinating GOPROXY and GOSUMDB to serve a client malicious module content that cannot be detected by evaluating the transparency log. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidyNVD analysis in progress High CVSS 7.5 CVE-2026-56865A malicious GOPROXY was previously capable of forging up to two sumdb tiles that allow for a requested module to bypass the GOSUMDB check and persist attacker-controlled module content to a local Go module cache. This attack allows for a malicious GOPROXY to serve malicious module content that cannot be detected by evaluating the transparency log. All tiles are now correctly verified against their parents. In order to determine if you have been affected: rm -r go.sum go.work.sum vendor/ && go mod tidyNVD analysis in progress High CVSS 8.4 CVE-2026-57894Repository Migration Follows Git HTTP Redirects After URL Allow/Block Validation, Enabling Internal Git Repository ExfiltrationNVD analysis in progress High CVSS 8.5 CVE-2026-58314Two SSRF findings in Gitea 1.26.2NVD analysis in progress High CVSS 7.7 CVE-2026-58416Fork-PR Actions task can read a third private repository via the collaborative-owner branch (missing fork-PR guard)NVD analysis in progress High CVSS 7.1 CVE-2026-58417REST API exposes organization membership of private organizations to publicNVD analysis in progress High CVSS 7.5 CVE-2026-58427Private org member list leaked via /members API endpoint — incomplete fix for PR #38145NVD analysis in progress High CVSS 7.5 CVE-2026-58433Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization settingNVD analysis in progress Critical CVSS 9.1 CVE-2026-58434Private Repository Metadata Remains Accessible After Access RevocationNVD analysis in progress High CVSS 7.5 CVE-2026-58436ParseAcceptLanguage quadratic-time DoS via Locale middleware on unauthenticated requestsNVD analysis in progress High CVSS 7.5 CVE-2026-58437Repository Visibility Manipulation via Git Push OptionsNVD analysis in progress High CVSS 7.1 CVE-2026-58438Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot accessNVD analysis in progress High CVSS 7.5 CVE-2026-58439Branch Protection Bypass via PR Retargeting Preserves Stale `official` Approval FlagNVD analysis in progress High CVSS 8.1 CVE-2026-58443Public-only repository tokens can update private PR head branchesNVD analysis in progress Critical CVSS 9.1 CVE-2026-58508Two SSRF vulnerabilities in Gitea migration/mirror (DNS rebinding + missing re-validation)NVD analysis in progress Critical CVSS 9.1 CVE-2026-59109SQL injection in the Zalktis accounting application via
trading-partner-controlled text fields in received electronic invoices. When
importing a received e-invoice (UBL/PEPPOL) or an e-commerce export, Zalktis
concatenates partner-controlled values directly into SQL statement text using
string concatenation, with neither parameterised queries nor escaping. The
application's own escaping helper, Dazadi.sql_txt(),
is not invoked on these code paths, so a party that sends an invoice can break
out of the string literal and alter the query logic.
This issue affects Zalktis: before 2026.1.586 and before 2026.2.592.NVD analysis in progress High CVSS 8.8 CVE-2026-59499CWE-200: Exposure of Sensitive
Information to an Unauthorized ActorNVD analysis in progress High CVSS 8.6 CVE-2026-59500CWE-287: Improper AuthenticationNVD analysis in progress Critical CVSS 10 2701–2800 / 11286 CVE