🚨 CVE-2026-34166
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.3, the replace filter in LiquidJS incorrectly accounts for memory usage when the memoryLimit option is enabled. It charges str.length + pattern.length + replacement.length bytes to the memory limiter, but the actual output from str.split(pattern).join(replacement) can be quadratically larger when the pattern occurs many times in the input string. This allows an attacker who controls template content to bypass the memoryLimit DoS protection with approximately 2,500x amplification, potentially causing out-of-memory conditions. This vulnerability is fixed in 10.25.3.
🎖@cveNotify
LiquidJS is a Shopify / GitHub Pages compatible template engine in pure JavaScript. Prior to 10.25.3, the replace filter in LiquidJS incorrectly accounts for memory usage when the memoryLimit option is enabled. It charges str.length + pattern.length + replacement.length bytes to the memory limiter, but the actual output from str.split(pattern).join(replacement) can be quadratically larger when the pattern occurs many times in the input string. This allows an attacker who controls template content to bypass the memoryLimit DoS protection with approximately 2,500x amplification, potentially causing out-of-memory conditions. This vulnerability is fixed in 10.25.3.
🎖@cveNotify
GitHub
fix: precise memoryLimit for string replace · harttle/liquidjs@abc058b
A simple, expressive, safe and Shopify compatible template engine in pure JavaScript. - fix: precise memoryLimit for string replace · harttle/liquidjs@abc058b
🚨 CVE-2026-34248
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, customers in shared organizations (means they can see each other's tickets) could see fields which are not intended for customers - including fields not intended for them at all (e.g. priority, custom ticket attributes for internal purposes). This was the case when a customer opened a ticket from another user of the same shared organization. They are not able to modify these field. This vulnerability is fixed in 7.0.1.
🎖@cveNotify
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, customers in shared organizations (means they can see each other's tickets) could see fields which are not intended for customers - including fields not intended for them at all (e.g. priority, custom ticket attributes for internal purposes). This was the case when a customer opened a ticket from another user of the same shared organization. They are not able to modify these field. This vulnerability is fixed in 7.0.1.
🎖@cveNotify
GitHub
Information disclosure in ticket detail view of customers in shared organizations
### Impact
Customers in shared organizations (means they can see each other's tickets) could see fields which are not intended for customers - including fields not intended for them at all (...
Customers in shared organizations (means they can see each other's tickets) could see fields which are not intended for customers - including fields not intended for them at all (...
🚨 CVE-2026-34392
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 20.0.0 to before 27.0.3 and 28.0.1, a bug in the static file router can allow an attacker to traverse outside of the intended directory, allowing unintended files to be downloaded through the static, css, and js endpoints. This vulnerability is fixed in 27.0.3 and 28.0.1.
🎖@cveNotify
LORIS (Longitudinal Online Research and Imaging System) is a self-hosted web application that provides data- and project-management for neuroimaging research. From 20.0.0 to before 27.0.3 and 28.0.1, a bug in the static file router can allow an attacker to traverse outside of the intended directory, allowing unintended files to be downloaded through the static, css, and js endpoints. This vulnerability is fixed in 27.0.3 and 28.0.1.
🎖@cveNotify
GitHub
Path traversal in static router
### Impact
A bug in the static file router can allow an attacker to traverse outside of the intended directory, allowing unintended files to be downloaded through the static, css, and js endpoints...
A bug in the static file router can allow an attacker to traverse outside of the intended directory, allowing unintended files to be downloaded through the static, css, and js endpoints...
🚨 CVE-2026-34718
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the HTML sanitizer for ticket articles was missing proper sanitization of data: ... URI schemes, resulting in storing such malicious content in the database of the Zammad instance. The Zammad GUI is rendering this content, due to applied CSP rules no harm was done by e.g., clicking such a link. This vulnerability is fixed in 7.0.1 and 6.5.4.
🎖@cveNotify
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the HTML sanitizer for ticket articles was missing proper sanitization of data: ... URI schemes, resulting in storing such malicious content in the database of the Zammad instance. The Zammad GUI is rendering this content, due to applied CSP rules no harm was done by e.g., clicking such a link. This vulnerability is fixed in 7.0.1 and 6.5.4.
🎖@cveNotify
GitHub
Improper neutralization of script-related HTML tags in ticket articles
### Impact
The HTML sanitizer for ticket articles was missing proper sanitization of `data: ...` URI schemes, resulting in storing such malicious content in the database of the Zammad instance.
...
The HTML sanitizer for ticket articles was missing proper sanitization of `data: ...` URI schemes, resulting in storing such malicious content in the database of the Zammad instance.
...
🚨 CVE-2026-34719
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the webhook model was missing a proper validation for loop back addresses, or link-local addresses — only the URL scheme (HTTP/HTTPS) as well as the hostname was checked. This could end up in retrieving confidential metadata of cloud/hosting providers. The existing check is now extended and is applied when configuring webhooks as well as triggering webhook jobs. This vulnerability is fixed in 7.0.1 and 6.5.4.
🎖@cveNotify
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the webhook model was missing a proper validation for loop back addresses, or link-local addresses — only the URL scheme (HTTP/HTTPS) as well as the hostname was checked. This could end up in retrieving confidential metadata of cloud/hosting providers. The existing check is now extended and is applied when configuring webhooks as well as triggering webhook jobs. This vulnerability is fixed in 7.0.1 and 6.5.4.
🎖@cveNotify
GitHub
Server-side request forgery (SSRF) via webhooks
### Impact
The webhook model was missing a proper validation for loop back addresses, or
link-local addresses — only the URL scheme (HTTP/HTTPS) as well as the hostname was checked. This could ...
The webhook model was missing a proper validation for loop back addresses, or
link-local addresses — only the URL scheme (HTTP/HTTPS) as well as the hostname was checked. This could ...
🚨 CVE-2026-34720
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the SSO mechanism in Zammad was not verifying the header originates from a trusted SSO proxy/gateway before applying further actions on it. This vulnerability is fixed in 7.0.1 and 6.5.4.
🎖@cveNotify
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the SSO mechanism in Zammad was not verifying the header originates from a trusted SSO proxy/gateway before applying further actions on it. This vulnerability is fixed in 7.0.1 and 6.5.4.
🎖@cveNotify
GitHub
Origin validation error in SSO mechanism
### Impact
The SSO mechanism in Zammad was not verifying the header originates from a trusted SSO proxy/gateway before applying further actions on it.
This is now possible to configure properly...
The SSO mechanism in Zammad was not verifying the header originates from a trusted SSO proxy/gateway before applying further actions on it.
This is now possible to configure properly...
🚨 CVE-2026-34721
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the OAuth callback endpoints for Microsoft, Google, and Facebook external credentials do not validate a CSRF state parameter. This vulnerability is fixed in 7.0.1 and 6.5.4.
🎖@cveNotify
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the OAuth callback endpoints for Microsoft, Google, and Facebook external credentials do not validate a CSRF state parameter. This vulnerability is fixed in 7.0.1 and 6.5.4.
🎖@cveNotify
GitHub
Cross-site request forgery (CSRF) in OAuth callback endpoints
### Impact
The OAuth callback endpoints for Microsoft, Google, and Facebook external credentials do not validate a CSRF state parameter.
The external credentials handling got hardened by introd...
The OAuth callback endpoints for Microsoft, Google, and Facebook external credentials do not validate a CSRF state parameter.
The external credentials handling got hardened by introd...
🚨 CVE-2026-34722
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the used endpoint for ticket creation was missing authorization if the related parameter for adding links is used. This vulnerability is fixed in 7.0.1 and 6.5.4.
🎖@cveNotify
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the used endpoint for ticket creation was missing authorization if the related parameter for adding links is used. This vulnerability is fixed in 7.0.1 and 6.5.4.
🎖@cveNotify
GitHub
Missing authorization in ticket create endpoint
### Impact
The used endpoint for ticket creation was missing authorization if the related parameter for adding links is used.
The endpoint got improved to ensure having proper permissions.
The used endpoint for ticket creation was missing authorization if the related parameter for adding links is used.
The endpoint got improved to ensure having proper permissions.
🚨 CVE-2026-34723
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, unauthenticated remote attackers were able to access the getting started endpoint to get access to sensitive internal entity data, even after the system setup was completed. This vulnerability is fixed in 7.0.1 and 6.5.4.
🎖@cveNotify
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, unauthenticated remote attackers were able to access the getting started endpoint to get access to sensitive internal entity data, even after the system setup was completed. This vulnerability is fixed in 7.0.1 and 6.5.4.
🎖@cveNotify
GitHub
Incorrect access control in getting_started_controller
### Impact
Unauthenticated remote attackers were able to access the getting started endpoint to get access to sensitive internal entity data, even after the system setup was completed.
Unauthenticated remote attackers were able to access the getting started endpoint to get access to sensitive internal entity data, even after the system setup was completed.
🚨 CVE-2026-34724
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a server-side template injection vulnerability which leads to RCE via AI Agent exists. Impact is limited to environments where an attacker can control or influence type_enrichment_data (typically high-privilege administrative configuration). This vulnerability is fixed in 7.0.1.
🎖@cveNotify
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, a server-side template injection vulnerability which leads to RCE via AI Agent exists. Impact is limited to environments where an attacker can control or influence type_enrichment_data (typically high-privilege administrative configuration). This vulnerability is fixed in 7.0.1.
🎖@cveNotify
GitHub
Server-side template injection leading to RCE via AI Agent
### Impact
- Remote code execution (RCE) on the Zammad application server in the context of the application process.
- Impact is limited to environments where an attacker can control or influen...
- Remote code execution (RCE) on the Zammad application server in the context of the application process.
- Impact is limited to environments where an attacker can control or influen...
🚨 CVE-2026-34782
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the REST endpoint POST /api/v1/ai_assistance/text_tools/:id was not checking if a user is privileged to use the text tool, resulting in being able to use it in all situations. This vulnerability is fixed in 7.0.1 and 6.5.4.
🎖@cveNotify
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the REST endpoint POST /api/v1/ai_assistance/text_tools/:id was not checking if a user is privileged to use the text tool, resulting in being able to use it in all situations. This vulnerability is fixed in 7.0.1 and 6.5.4.
🎖@cveNotify
GitHub
Missing authorization in AI assistance controller for text tools
### Impact
The REST endpoint POST `/api/v1/ai_assistance/text_tools/:id` was not checking if a user is privileged to use the text tool, resulting in being able to use it in all situations.
Th...
The REST endpoint POST `/api/v1/ai_assistance/text_tools/:id` was not checking if a user is privileged to use the text tool, resulting in being able to use it in all situations.
Th...
🚨 CVE-2026-34837
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, he REST endpoint POST /api/v1/ai_assistance/text_tools/:id contains an authorization failure. Context data (e.g., a group or organization) supplied to be used in the AI prompt were not checked if they are accessible for the current user. This leads to having data present in the AI prompt that were not authorized before being used. A user needs to have ticket.agent permission to be able to use the provided context data. This vulnerability is fixed in 7.0.1.
🎖@cveNotify
Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, he REST endpoint POST /api/v1/ai_assistance/text_tools/:id contains an authorization failure. Context data (e.g., a group or organization) supplied to be used in the AI prompt were not checked if they are accessible for the current user. This leads to having data present in the AI prompt that were not authorized before being used. A user needs to have ticket.agent permission to be able to use the provided context data. This vulnerability is fixed in 7.0.1.
🎖@cveNotify
GitHub
Missing authorization in AI assistance controller for context data used in text tools
### Impact
The REST endpoint POST `/api/v1/ai_assistance/text_tools/:id` contains an authorization failure:
Context data (e.g., a group or organization) supplied to be used in the AI prompt w...
The REST endpoint POST `/api/v1/ai_assistance/text_tools/:id` contains an authorization failure:
Context data (e.g., a group or organization) supplied to be used in the AI prompt w...
🚨 CVE-2026-3438
A reflected cross-site scripting vulnerability exists in Sonatype Nexus Repository versions 3.0.0 through 3.90.2 that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted URL. Exploitation requires user interaction.
🎖@cveNotify
A reflected cross-site scripting vulnerability exists in Sonatype Nexus Repository versions 3.0.0 through 3.90.2 that allows unauthenticated remote attackers to execute arbitrary JavaScript in a victim's browser through a specially crafted URL. Exploitation requires user interaction.
🎖@cveNotify
🚨 CVE-2026-33120
Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network.
🎖@cveNotify
Untrusted pointer dereference in SQL Server allows an authorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-33822
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
🎖@cveNotify
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
🎖@cveNotify
🚨 CVE-2026-33824
Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-33825
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.
🎖@cveNotify
🚨 CVE-2026-33826
Improper input validation in Windows Active Directory allows an authorized attacker to execute code over an adjacent network.
🎖@cveNotify
Improper input validation in Windows Active Directory allows an authorized attacker to execute code over an adjacent network.
🎖@cveNotify
🚨 CVE-2026-33827
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an unauthorized attacker to execute code over a network.
🎖@cveNotify
🚨 CVE-2026-34614
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.
🎖@cveNotify
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a reflected Cross-Site Scripting (XSS) vulnerability. If an attacker is able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser. Scope is changed.
🎖@cveNotify
Adobe
Adobe Security Bulletin
Security updates available for Adobe Connect | APSB2
🚨 CVE-2026-34615
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
🎖@cveNotify
Adobe Connect versions 2025.3, 12.10 and earlier are affected by a Deserialization of Untrusted Data vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to inject malicious scripts into a web page, potentially gaining elevated access or control over the victim's account or session. Exploitation of this issue requires user interaction in that a victim must visit a maliciously crafted URL or interact with a compromised web page. Scope is changed.
🎖@cveNotify
Adobe
Adobe Security Bulletin
Security updates available for Adobe Connect | APSB2