🚨 CVE-2026-48978
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1.
🎖@cveNotify
oras-go is a Go library for managing OCI artifacts. Prior to 2.6.1, auth.Client follows the realm URL from a registry's WWW-Authenticate: Bearer challenge without validating the scheme or host, allowing a malicious or compromised registry to cause SSRF to internal networks such as http://169.254.169.254/, http://10.0.0.x/, and http://127.0.0.1/, or to downgrade a registry contacted over https:// to an http:// token endpoint in registry/remote/auth/client.go through Client.Do(), Client.fetchBearerToken(), fetchDistributionToken, and fetchOAuth2Token. This issue is fixed in version 2.6.1.
🎖@cveNotify
GitHub
Merge commit from fork · oras-project/oras-go@7a9f4b0
* fix(auth): validate bearer realm host to prevent credential exfiltration
A malicious registry can set the WWW-Authenticate Bearer realm to an
attacker-controlled URL. Without validation, ORAS wo...
A malicious registry can set the WWW-Authenticate Bearer realm to an
attacker-controlled URL. Without validation, ORAS wo...
🚨 CVE-2026-54464
### Impact
If this library is used in tandem with the `permessage-deflate` extension, a
WebSocket server or client can be made to accept messages that are larger than
the configured maximum message size. This is because this limit is checked
against the message frames' length headers, which give the size of the
compressed data, not the size after decompression. This can lead to applications
accepting larger messages than expected and exceeding their intended resource
usage.
### Patches
The issue has been patched in version 0.8.1, by checking the length of messages
after they are processed by incoming extensions. All users should upgrade to
this version.
### Workarounds
No known workarounds exist.
### Acknowledgements
This issue was discovered and reported by Pranjali Thakur, DepthFirst Security
Research Team.
🎖@cveNotify
### Impact
If this library is used in tandem with the `permessage-deflate` extension, a
WebSocket server or client can be made to accept messages that are larger than
the configured maximum message size. This is because this limit is checked
against the message frames' length headers, which give the size of the
compressed data, not the size after decompression. This can lead to applications
accepting larger messages than expected and exceeding their intended resource
usage.
### Patches
The issue has been patched in version 0.8.1, by checking the length of messages
after they are processed by incoming extensions. All users should upgrade to
this version.
### Workarounds
No known workarounds exist.
### Acknowledgements
This issue was discovered and reported by Pranjali Thakur, DepthFirst Security
Research Team.
🎖@cveNotify
GitHub
Fail the connection if a message is larger than the configured max le… · faye/websocket-driver-ruby@fa86417
…ngth after extension processing
🚨 CVE-2026-7771
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a trap when compiling a specially crafted statements containing subqueries could lead to a denial of service.
🎖@cveNotify
IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.4 is vulnerable to a trap when compiling a specially crafted statements containing subqueries could lead to a denial of service.
🎖@cveNotify
Ibm
Security Bulletin: IBM® Db2® is vulnerable to a trap when compiling specially crafted statements containing subqueries could…
IBM® Db2® is vulnerable to a trap when compiling specially crafted statements containing subqueries could lead to a denial of service.
🚨 CVE-2026-8635
IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system commands, and achieve full system compromise with Langflow service permissions.
🎖@cveNotify
IBM Langflow OSS 1.0.0 through 1.10.0 allows authenticated users to escalate privileges to superuser by directly manipulating the database, execute arbitrary system commands, and achieve full system compromise with Langflow service permissions.
🎖@cveNotify
Ibm
Security Bulletin: Arbitrary Code Execution in Python Interpreter Component
A vulnerability in the Python Interpreter component allowed authenticated users to execute arbitrary Python code and escalate privileges to superuser level. An attacker with valid credentials could bypass security controls through the PythonREPLComponent…
🚨 CVE-2026-16332
A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /mydlink/multi_uploadify.php. Performing a manipulation of the argument Filedata[] results in unrestricted upload. The attack is possible to be carried out remotely. The exploit is now public and may be used.
🎖@cveNotify
A vulnerability was detected in D-Link DNS-320 1.0.2. This impacts an unknown function of the file /mydlink/multi_uploadify.php. Performing a manipulation of the argument Filedata[] results in unrestricted upload. The attack is possible to be carried out remotely. The exploit is now public and may be used.
🎖@cveNotify
ucn9h68n9289.feishu.cn
Docs
🚨 CVE-2026-16334
A vulnerability was identified in itsourcecode Hospital Management System 1.0. This vulnerability affects unknown code of the file /prescriptionorder.php. Such manipulation of the argument editid leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.
🎖@cveNotify
A vulnerability was identified in itsourcecode Hospital Management System 1.0. This vulnerability affects unknown code of the file /prescriptionorder.php. Such manipulation of the argument editid leads to sql injection. The attack can be launched remotely. The exploit is publicly available and might be used.
🎖@cveNotify
GitHub
itsourcecode Hospital Management System V1.0 SQL Injection Vulnerability · Issue #1 · LiamJim/cve
itsourcecode Hospital Management System V1.0 SQL Injection Vulnerability NAME OF AFFECTED PRODUCT(S) Hospital Management System Vendor Homepage https://itsourcecode.com/free-projects/php-project/ho...
🚨 CVE-2026-63729
The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.
🎖@cveNotify
The SyncTeX parser (synctex_parser.c) shipped with TeX Live and embedded by downstream consumers such as GNOME Evince contains a heap use-after-free vulnerability that allows attackers to crash applications or potentially execute arbitrary code by supplying a malformed .synctex or .synctex.gz file. A malformed SyncTeX file can construct a ref node with a NULL parent pointer, causing the replacement routine to fail to detach the node from its sibling chain, which triggers recursive freeing of live tree nodes and leaves dangling pointers that are later accessed by the parser during document load.
🎖@cveNotify
Fatih’s Blog
Use-After-Free in SyncTeX Parser
Analysis of a Heap Use-After-Free vulnerability discovered in the SyncTeX parser.
🚨 CVE-2026-6952
A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B1 firmware versions through 5.17(ABPC.7.2)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.
🎖@cveNotify
A post-authentication command injection vulnerability in the "LogServer" field of the syslog component in Zyxel AX7501-B1 firmware versions through 5.17(ABPC.7.2)C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device.
🎖@cveNotify
Zyxel
Zyxel security advisory for post-authentication command injection vulnerability in certain DSL/Ethernet CPE, Fiber ONTs, and Wireless…
CVE: CVE-2026-6952 Summary Zyxel has released patches for specific firmware versions of its DSL/Ethernet CPE, fiber ONTs, and Wireless Extenders. These updates address the command injection vulnerability. Users are strongly advised to install the patches…
🚨 CVE-2026-50427
Use after free in Content Delivery Manager allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Use after free in Content Delivery Manager allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-50428
Out-of-bounds read in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to disclose information locally.
🎖@cveNotify
Out-of-bounds read in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to disclose information locally.
🎖@cveNotify
🚨 CVE-2026-50430
Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose information locally.
🎖@cveNotify
Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose information locally.
🎖@cveNotify
🚨 CVE-2026-50431
Windows Quality of Service (QoS) Packet Scheduler Information Disclosure Vulnerability
🎖@cveNotify
Windows Quality of Service (QoS) Packet Scheduler Information Disclosure Vulnerability
🎖@cveNotify
🚨 CVE-2026-50432
Use after free in Windows Virtual Filtering Platform (VFP) allows an authorized attacker to deny service over a network.
🎖@cveNotify
Use after free in Windows Virtual Filtering Platform (VFP) allows an authorized attacker to deny service over a network.
🎖@cveNotify
🚨 CVE-2026-50433
Use after free in Windows Media allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Use after free in Windows Media allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-50434
Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose information locally.
🎖@cveNotify
Exposure of sensitive information to an unauthorized actor in Windows Push Notifications allows an authorized attacker to disclose information locally.
🎖@cveNotify
🚨 CVE-2026-50435
Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-50479
Untrusted pointer dereference in Windows USB Hub Driver allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Untrusted pointer dereference in Windows USB Hub Driver allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-50480
Heap-based buffer overflow in Windows Web Proxy Auto-Discovery Protocol (WPAD) allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Heap-based buffer overflow in Windows Web Proxy Auto-Discovery Protocol (WPAD) allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-50482
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
🎖@cveNotify
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
🎖@cveNotify
🚨 CVE-2026-50483
Exposure of sensitive information to an unauthorized actor in Microsoft Graphics Component allows an authorized attacker to disclose information locally.
🎖@cveNotify
Exposure of sensitive information to an unauthorized actor in Microsoft Graphics Component allows an authorized attacker to disclose information locally.
🎖@cveNotify
🚨 CVE-2026-9804
A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod's filesystem. This leads to information disclosure, potentially exposing sensitive data.
🎖@cveNotify
A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod's filesystem. This leads to information disclosure, potentially exposing sensitive data.
🎖@cveNotify