🚨 CVE-2026-73067
Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loaded through TessBaseAPI::Init can cause SquishedDawg::read_squished_dawg in src/dict/dawg.cpp to accept an unterminated forward-edge run, after which SquishedDawg::Load calls num_forward_edges(0) and last_edge in src/dict/dawg.h reads beyond edges_, causing a heap out-of-bounds read and process crash before image processing. This issue is fixed in version 5.5.3.
🎖@cveNotify
Tesseract is an open source OCR engine. Prior to 5.5.3, a crafted .traineddata model loaded through TessBaseAPI::Init can cause SquishedDawg::read_squished_dawg in src/dict/dawg.cpp to accept an unterminated forward-edge run, after which SquishedDawg::Load calls num_forward_edges(0) and last_edge in src/dict/dawg.h reads beyond edges_, causing a heap out-of-bounds read and process crash before image processing. This issue is fixed in version 5.5.3.
🎖@cveNotify
GitHub
Fix unbounded allocation and validate DAWG edge structure · tesseract-ocr/tesseract@55287a9
Bound num_edges_ against remaining component bytes before allocating
the edges_ array in read_squished_dawg. This prevents a crafted
num_edges_ = 0x7FFFFFFF from requesting ~17 GB and aborting via
...
the edges_ array in read_squished_dawg. This prevents a crafted
num_edges_ = 0x7FFFFFFF from requesting ~17 GB and aborting via
...
🚨 CVE-2025-31114
Fooocus is an image generating software. In versions 2.5.5 and prior, the Fooocus web UI is vulnerable to remote code execution due to the unsafe use of eval when processing metadata JSON. An attacker with access to the Fooocus web UI may be able to execute arbitrary code on the instance. As of time of publication, no known patched versions are available, but a suggested fix pull request is available.
🎖@cveNotify
Fooocus is an image generating software. In versions 2.5.5 and prior, the Fooocus web UI is vulnerable to remote code execution due to the unsafe use of eval when processing metadata JSON. An attacker with access to the Fooocus web UI may be able to execute arbitrary code on the instance. As of time of publication, no known patched versions are available, but a suggested fix pull request is available.
🎖@cveNotify
GitHub
[Bug]: Github Security Lab Vulnerability Report · Issue #3552 · lllyasviel/Fooocus
Checklist The issue has not been resolved by following the troubleshooting guide The issue exists on a clean installation of Fooocus The issue exists in the current version of Fooocus The issue has...
🚨 CVE-2026-11733
A buffer overflow vulnerability in the listed NETGEAR models allows a device administrator to temporarily interrupt the normal operation of the affected device.
🎖@cveNotify
A buffer overflow vulnerability in the listed NETGEAR models allows a device administrator to temporarily interrupt the normal operation of the affected device.
🎖@cveNotify
NETGEAR
RAX41 | Nighthawk AX5 5-Stream AX3600 WiFi Router
Find setup help, user guides, product information, firmware, and troubleshooting for your Nighthawk RAX41 on our official NETGEAR Support site today.
🚨 CVE-2026-11734
A buffer overflow vulnerability in the listed NETGEAR models allows an authenticated admin user to cause the affected device to become temporarily unavailable.
🎖@cveNotify
A buffer overflow vulnerability in the listed NETGEAR models allows an authenticated admin user to cause the affected device to become temporarily unavailable.
🎖@cveNotify
NETGEAR
MR70 | Nighthawk Mesh WiFi 6 Router
Find setup help, user guides, product information, firmware, and troubleshooting for your Nighthawk MR70 router on our official NETGEAR Support site today.
🚨 CVE-2026-11735
A stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin user to make unauthorized modification to the router's software and functionality.
🎖@cveNotify
A stack-based buffer overflow vulnerability affects the listed NETGEAR models allowing an authenticated admin user to make unauthorized modification to the router's software and functionality.
🎖@cveNotify
NETGEAR
R7000 | Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router
Find setup help, user guides, product information, firmware, and troubleshooting for your Nighthawk R7000 on our official NETGEAR Support site today.
🚨 CVE-2026-11736
A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make unauthorized modification to router software and functionality.
🎖@cveNotify
A stack-based buffer overflow vulnerability affects certain NETGEAR models allowing an authenticated admin user to make unauthorized modification to router software and functionality.
🎖@cveNotify
NETGEAR
RAX20 | 4-Stream AX1800 WiFi 6 Router
Find setup help, user guides, product information, firmware, and troubleshooting for your RAX20 on our official NETGEAR Support site today.
🚨 CVE-2026-11737
Insufficient input validation vulnerability in the listed
NETGEAR models allows authenticated administrators connected to the
local network to make unauthorized modification to the device software and
functionality.
🎖@cveNotify
Insufficient input validation vulnerability in the listed
NETGEAR models allows authenticated administrators connected to the
local network to make unauthorized modification to the device software and
functionality.
🎖@cveNotify
NETGEAR
RAX20 | 4-Stream AX1800 WiFi 6 Router
Find setup help, user guides, product information, firmware, and troubleshooting for your RAX20 on our official NETGEAR Support site today.
🚨 CVE-2026-11738
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality.
🎖@cveNotify
Insufficient input validation vulnerability in the listed NETGEAR models allows authenticated administrators connected to the local network to make unauthorized modification to router software and functionality.
🎖@cveNotify
NETGEAR
R7000 | Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router
Find setup help, user guides, product information, firmware, and troubleshooting for your Nighthawk R7000 on our official NETGEAR Support site today.
🚨 CVE-2026-11739
A command injection vulnerability in certain affected NETGEAR Nighthawk
devices allows a network-adjacent attacker with the ability to intercept
and modify local network traffic (attacker in the middle) to compromise
the confidentiality and integrity of the affected device.
🎖@cveNotify
A command injection vulnerability in certain affected NETGEAR Nighthawk
devices allows a network-adjacent attacker with the ability to intercept
and modify local network traffic (attacker in the middle) to compromise
the confidentiality and integrity of the affected device.
🎖@cveNotify
NETGEAR
MR60 | Nighthawk Mesh WiFi 6 Router
Find setup help, user guides, product information, firmware, and troubleshooting for your Nighthawk MR60 router on our official NETGEAR Support site today.
🚨 CVE-2026-11814
A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker-in-the-middle) to compromise the confidentiality and integrity of the affected device. This issue is limited to certain region-specific SKUs.
🎖@cveNotify
A command injection vulnerability in the listed NETGEAR models allows a network-adjacent attacker with the ability to intercept and modify local network traffic (attacker-in-the-middle) to compromise the confidentiality and integrity of the affected device. This issue is limited to certain region-specific SKUs.
🎖@cveNotify
NETGEAR
BE9300 | Nighthawk WiFi 7 Tri-Band Router
Find setup help, user guides, product information, firmware, and troubleshooting for your Nighthawk BE9300 wifi router on our official NETGEAR Support site today.
🚨 CVE-2026-14180
A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, "smuggled" request to be processed out of sync, potentially bypassing security controls.
🎖@cveNotify
A flaw was found in the ChunkReader component of the Undertow HTTP server, which is used by WildFly and JBoss EAP to handle chunked transfer encoding. The issue occurs because the parser uses a single internal variable to store both the remaining chunk size and state flags. By sending a specially crafted request with an extremely large chunk size, an attacker can cause these values to overlap, tricking the parser into thinking a request has finished prematurely. This can allow a second, "smuggled" request to be processed out of sync, potentially bypassing security controls.
🎖@cveNotify
Redhat
CVE-2026-14180 - Red Hat Customer Portal
CVE Details App
🚨 CVE-2026-18638
Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist.
🎖@cveNotify
Any authenticated Velociraptor user — including one holding only the readerrole — can terminate the entire server process with a single request, by calling SetPassword with a username that does not exist.
🎖@cveNotify
🚨 CVE-2026-18639
When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email.
This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.
🎖@cveNotify
When Velociraptor is configured to use an OIDC IdP for authentication, it uses the email claim as a username. However, some IdP allow users to change the email claim without verification. Some IdPs do not set the "email_verified" claim and do not actually verify the email.
This allows a user to impersonate another user by setting their email address within the IdP, allowing account takeover.
🎖@cveNotify
🚨 CVE-2026-18640
The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOK_EDIT permission to write the notebook record outside the org's data store directory. The file written must have an extension of ".json.db" but can otherwise overwrite other metadata files (such as ACL records, hunts etc). This can corrupt these files and cause data corruption.
🎖@cveNotify
The NewNotebook API does not sufficiently sanitize its parameters allowing an authenticated user with NOTEBOOK_EDIT permission to write the notebook record outside the org's data store directory. The file written must have an extension of ".json.db" but can otherwise overwrite other metadata files (such as ACL records, hunts etc). This can corrupt these files and cause data corruption.
🎖@cveNotify
🚨 CVE-2026-19078
A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly validated. A remote attacker can craft a malicious URL that, when approved or denied by an authenticated user, redirects them to an attacker-controlled website. This could enable phishing attacks, potentially tricking users into revealing sensitive information.
🎖@cveNotify
A flaw was found in the oauth-server component. This open redirect vulnerability occurs when the 'then' parameter in the grant approval handler is not properly validated. A remote attacker can craft a malicious URL that, when approved or denied by an authenticated user, redirects them to an attacker-controlled website. This could enable phishing attacks, potentially tricking users into revealing sensitive information.
🎖@cveNotify
Redhat
CVE-2026-19078 - Red Hat Customer Portal
CVE Details App
🚨 CVE-2026-19546
A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z.
For a detailed Statement, Description and Mitigation please reffer to the original https://access.redhat.com/security/cve/cve-2026-19546.
🎖@cveNotify
A flaw was found in DBI. This is a fix for a partial fix for CVE-2026-14380 for RHEL 9.8.z and 10.2.z.
For a detailed Statement, Description and Mitigation please reffer to the original https://access.redhat.com/security/cve/cve-2026-19546.
🎖@cveNotify
Redhat
CVE-2026-19546 - Red Hat Customer Portal
CVE Details App
🚨 CVE-2026-42142
TypeBot is a chatbot builder tool. Prior to version 3.17.0, the `handleGetSheets` API handler (`POST /api/sheets/getSheets`) does not validate workspace membership, allowing any authenticated user to access and decrypt another workspace's Google Sheets OAuth credentials and retrieve spreadsheet data (sheet names, IDs, column headers). Version 3.17.0 fixes the issue.
🎖@cveNotify
TypeBot is a chatbot builder tool. Prior to version 3.17.0, the `handleGetSheets` API handler (`POST /api/sheets/getSheets`) does not validate workspace membership, allowing any authenticated user to access and decrypt another workspace's Google Sheets OAuth credentials and retrieve spreadsheet data (sheet names, IDs, column headers). Version 3.17.0 fixes the issue.
🎖@cveNotify
GitHub
🐛 Fix missing workspace membership check in getSheets endpoint (#2467) · baptisteArno/typebot.io@91d2a98
- Add `context: { user }` parameter to `handleGetSheets` to access the
authenticated user
- Fetch the workspace and validate access with `isReadWorkspaceFobidden`
before calling `getGoogleSpreadshe...
authenticated user
- Fetch the workspace and validate access with `isReadWorkspaceFobidden`
before calling `getGoogleSpreadshe...
🚨 CVE-2026-48495
TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callback decodes a base64-encoded JSON `state` parameter and trusts the embedded `workspaceId`, `typebotId`, `blockId`, and `redirectUrl` without cryptographic integrity protection or authorization checks. The callback route is authenticated, but it does not verify that the authenticated user has write access to the target workspace or Typebot before creating credentials in the workspace or updating Typebot groups. An authenticated user who can obtain a valid Google OAuth `code` can alter the `state` value to create Google Sheets credentials in another workspace and, if target IDs are known, attach those credentials to a block in another Typebot. Version 3.17.0 patches the issue.
🎖@cveNotify
TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callback decodes a base64-encoded JSON `state` parameter and trusts the embedded `workspaceId`, `typebotId`, `blockId`, and `redirectUrl` without cryptographic integrity protection or authorization checks. The callback route is authenticated, but it does not verify that the authenticated user has write access to the target workspace or Typebot before creating credentials in the workspace or updating Typebot groups. An authenticated user who can obtain a valid Google OAuth `code` can alter the `state` value to create Google Sheets credentials in another workspace and, if target IDs are known, attach those credentials to a block in another Typebot. Version 3.17.0 patches the issue.
🎖@cveNotify
GitHub
🐛 Fix Google Sheets OAuth callback authorization (#2501) · baptisteArno/typebot.io@c0ffd82
- Secure Google Sheets OAuth state with a signed payload, expiry, user
binding, and HttpOnly nonce cookie.
- Enforce workspace and typebot write authorization before generating
consent URLs and bef...
binding, and HttpOnly nonce cookie.
- Enforce workspace and typebot write authorization before generating
consent URLs and bef...
🚨 CVE-2026-53413
Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve remote code execution of another participant via network access.
🎖@cveNotify
Missing bounds check in the annotator function of Zoom Clients allows buffer over-write, which may allow a meeting participant to achieve remote code execution of another participant via network access.
🎖@cveNotify
Zoom
ZSB-26015
🚨 CVE-2026-53414
Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting participant to conduct a denial of service on another participant via network access.
🎖@cveNotify
Missing bounds check in the annotator function of Zoom Clients allows buffer over-read, which may allow a meeting participant to conduct a denial of service on another participant via network access.
🎖@cveNotify
Zoom
ZSB-26016
🚨 CVE-2026-53415
Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code execution of another participant via network access.
🎖@cveNotify
Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code execution of another participant via network access.
🎖@cveNotify
Zoom
ZSB-26017