🚨 CVE-2026-53415
Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code execution of another participant via network access.
🎖@cveNotify
Use after Free in the annotator function of Zoom Clients may allow a meeting participant to achieve remote code execution of another participant via network access.
🎖@cveNotify
Zoom
ZSB-26017
🚨 CVE-2026-53416
Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosure via local access.
🎖@cveNotify
Path traversal in Zoom VDI Client and Plugins may allow an authenticated user to conduct information disclosure via local access.
🎖@cveNotify
Zoom
ZSB-26017
🚨 CVE-2026-56720
CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint with an enumerable sequential integer user ID to disclose profile information of any user, including administrators, due to the profile action being excluded from the role validation filter with no compensating ownership check.
🎖@cveNotify
CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access any other user's profile data by supplying an arbitrary user ID parameter. Attackers can send a GET request to the admin profile endpoint with an enumerable sequential integer user ID to disclose profile information of any user, including administrators, due to the profile action being excluded from the role validation filter with no compensating ownership check.
🎖@cveNotify
GitHub
GitHub - owen2345/camaleon-cms: Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails
Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails - owen2345/camaleon-cms
🚨 CVE-2026-56721
CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference (IDOR) that allows authenticated low-privileged attackers to overwrite any user's credentials by exploiting a parameter confusion flaw between the authorization filter and action body in the UsersController. Attackers can send a PATCH request to the updated_ajax endpoint setting params[:id] to their own user ID to pass the self-authorization check while simultaneously setting params[:user_id] to a victim's ID, causing the controller to load and mutate the victim's account, including overwriting administrator passwords to achieve full site takeover.
🎖@cveNotify
CamaleonCMS version 2.9.2 and earlier contains a privilege escalation vulnerability via insecure direct object reference (IDOR) that allows authenticated low-privileged attackers to overwrite any user's credentials by exploiting a parameter confusion flaw between the authorization filter and action body in the UsersController. Attackers can send a PATCH request to the updated_ajax endpoint setting params[:id] to their own user ID to pass the self-authorization check while simultaneously setting params[:user_id] to a victim's ID, causing the controller to load and mutate the victim's account, including overwriting administrator passwords to achieve full site takeover.
🎖@cveNotify
GitHub
GitHub - owen2345/camaleon-cms: Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails
Camaleon CMS is a dynamic and advanced content management system based on Ruby on Rails - owen2345/camaleon-cms
🚨 CVE-2026-67179
Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits (via DNS rebinding), can reach POST /api/runAction on the Dev UI server (default port 4000) and execute any registered Genkit action and read the result. Fixed on 2026-06-18.
🎖@cveNotify
Genkit does not properly validate host request headers. Any host on the developer's network, and any website the developer visits (via DNS rebinding), can reach POST /api/runAction on the Dev UI server (default port 4000) and execute any registered Genkit action and read the result. Fixed on 2026-06-18.
🎖@cveNotify
GitHub
[security] Genkit local dev servers bind all interfaces with no Host-header validation, enabling DNS-rebinding execution of arbitrary…
https://github.com/genkit-ai/genkit/security/advisories/GHSA-273q-hccx-23r6 and as advised by https://issuetracker.google.com/issues/525169408 to create issue: Unfortunately, according to the [OSS ...
🚨 CVE-2026-67180
Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing request or influence an evidence path/name obtains code execution on the worker fleet. Fixed on 2026-07-10.
🎖@cveNotify
Google Turbinia allows arbitrary command execution via worker tasks. An attacker with privileges to submit a processing request or influence an evidence path/name obtains code execution on the worker fleet. Fixed on 2026-07-10.
🎖@cveNotify
GitHub
Command injection (RCE) in worker tasks via evidence path interpolated into a shell=True command · Issue #1629 · google/turbinia
What steps will reproduce the bug? Summary Several Turbinia worker tasks build a shell command by string-formatting an evidence path (evidence.local_path / evidence.device_path) directly into the c...
🚨 CVE-2026-6726
An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key (such as an Attestation Key, DevID Key or TLS authentication key) and falsify other TPM 2.0 attestations with this key. See also TCG VRT0010.
🎖@cveNotify
An information leakage vulnerability was reported in the TCG TPM 2.0 reference code that could allow a local attacker with elevated privileges to obtain a credential from a TPM-aware CA for a falsified TPM key (such as an Attestation Key, DevID Key or TLS authentication key) and falsify other TPM 2.0 attestations with this key. See also TCG VRT0010.
🎖@cveNotify
Trusted Computing Group
Errata for TPM Library Specification 2.0 | Trusted Computing Group
This document describes errata and clarifications for the TCG Trusted Platform Module Library Version 2.0 Revision 1.16, 1.38, 1.59, 1.83, 184, 185 as published. The information in this document is … Continue reading "Errata for TPM Library Specification…
🚨 CVE-2026-6727
A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys, including the RSA Endorsement Key (EK), including import blobs, credential blobs, and session salts. Under certain conditions, this may also enable the forgery of TPM 2.0 attestations. Refer to TCGVRT0011.
🎖@cveNotify
A timing side-channel vulnerability exists in the RSA OAEP decryption implementation. A privileged local attacker with access to the TPM command interface may be able to exploit timing differences to recover information that could allow decryption of ciphertexts encrypted to TPM-managed RSA keys, including the RSA Endorsement Key (EK), including import blobs, credential blobs, and session salts. Under certain conditions, this may also enable the forgery of TPM 2.0 attestations. Refer to TCGVRT0011.
🎖@cveNotify
Trusted Computing Group
Security | Trusted Computing Group
TCG Vulnerability Disclosure Policy Overview The Trusted Computing Group (TCG) as a standards organization is committed to receiving and responding to reports of potential vulnerabilities in TCG-developed technologies such as … Continue reading "Security"
🚨 CVE-2026-73068
ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.207, the ToolJet Database HTTP API in server/src/modules/tooljet-db/controller.ts authorizes operations against the :organizationId URL path value without verifying that the caller belongs to that organization. JwtAuthGuard validates the tj-workspace-id header against the caller's memberships, while server/src/modules/tooljet-db/ability/index.ts grants VIEW_TABLES, VIEW_TABLE, and JOIN_TABLES without binding them to the path organization. An authenticated user can set tj-workspace-id to the user's own workspace and target another workspace through GET /api/tooljet-db/organizations/:organizationId/tables, GET /api/tooljet-db/organizations/:organizationId/table/:tableName, POST /api/tooljet-db/organizations/:organizationId/join, and the related table-management routes, allowing disclosure of table names, schemas, and rows and allowing tables to be created, altered, bulk populated, or dropped across tenant boundaries. This issue is fixed in version 3.20.207-lts.
🎖@cveNotify
ToolJet is the open-source foundation am AI-native platform for building and deploying internal tools, workflows and AI agents. Prior to 3.20.207, the ToolJet Database HTTP API in server/src/modules/tooljet-db/controller.ts authorizes operations against the :organizationId URL path value without verifying that the caller belongs to that organization. JwtAuthGuard validates the tj-workspace-id header against the caller's memberships, while server/src/modules/tooljet-db/ability/index.ts grants VIEW_TABLES, VIEW_TABLE, and JOIN_TABLES without binding them to the path organization. An authenticated user can set tj-workspace-id to the user's own workspace and target another workspace through GET /api/tooljet-db/organizations/:organizationId/tables, GET /api/tooljet-db/organizations/:organizationId/table/:tableName, POST /api/tooljet-db/organizations/:organizationId/join, and the related table-management routes, allowing disclosure of table names, schemas, and rows and allowing tables to be created, altered, bulk populated, or dropped across tenant boundaries. This issue is fixed in version 3.20.207-lts.
🎖@cveNotify
GitHub
Cross Tenant TJDB Vulnerabilities (#17298) · ToolJet/ToolJet@4c1dbef
* sus
* gaps
* query guard
* gaps
* query guard
🚨 CVE-2026-73069
Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.15.0, Twenty allowed a workspace administrator with the DATA_MODEL permission to supply settings.asExpression for the system TS_VECTOR field searchVector through PATCH /rest/metadata/fields/:id or the updateOneField GraphQL mutation, causing buildSqlColumnDefinition in packages/twenty-server/src/engine/twenty-orm/workspace-schema-manager/utils/build-sql-column-definition.util.ts to concatenate unescaped input into GENERATED ALWAYS AS (...) and execute arbitrary PostgreSQL statements as the application database user. This issue is fixed in version 2.15.0.
🎖@cveNotify
Twenty is an open-source CRM (customer relationship management) platform. Prior to 2.15.0, Twenty allowed a workspace administrator with the DATA_MODEL permission to supply settings.asExpression for the system TS_VECTOR field searchVector through PATCH /rest/metadata/fields/:id or the updateOneField GraphQL mutation, causing buildSqlColumnDefinition in packages/twenty-server/src/engine/twenty-orm/workspace-schema-manager/utils/build-sql-column-definition.util.ts to concatenate unescaped input into GENERATED ALWAYS AS (...) and execute arbitrary PostgreSQL statements as the application database user. This issue is fixed in version 2.15.0.
🎖@cveNotify
GitHub
Refactor search vector field (#21947) · twentyhq/twenty@0b8368c
# Introduction
Refactoring the search vector field validation
<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/p...
Refactoring the search vector field validation
<!-- This is an auto-generated description by cubic. -->
<a
href="https://cubic.dev/pr/twentyhq/twenty/p...
🚨 CVE-2026-73070
Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c accepts unbounded client connections in socketserver_accept(), causing descriptors to overflow fd_set structures in src/channel.c and fixed-size struct pollfd arrays in src/os_unix.c, which allows a local process that can connect to the server socket to corrupt stack memory or terminate the Vim server. This issue is fixed in version 9.2.0842.
🎖@cveNotify
Vim is an open source, command line text editor. Prior to 9.2.0842, the socket server backend in src/socketserver.c accepts unbounded client connections in socketserver_accept(), causing descriptors to overflow fd_set structures in src/channel.c and fixed-size struct pollfd arrays in src/os_unix.c, which allows a local process that can connect to the server socket to corrupt stack memory or terminate the Vim server. This issue is fixed in version 9.2.0842.
🎖@cveNotify
GitHub
patch 9.2.0842: [security]: stack buffer overflow in socket server · vim/vim@5598618
Problem: [security]: stack buffer overflow in socket server
(tdjackey)
Solution: Cap accepted socketserver clients (Yasuhiro Matsumoto)
Github Security Advisory:
https://github.com/vim/...
(tdjackey)
Solution: Cap accepted socketserver clients (Yasuhiro Matsumoto)
Github Security Advisory:
https://github.com/vim/...
🚨 CVE-2026-73071
Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.
🎖@cveNotify
Vim is an open source, command line text editor. From 9.2.0511 until 9.2.0844, json_decode_item() in src/json.c can retain a stale pointer after json_decode_string() invokes channel_fill() to refill and free the current buffer, causing the error path to read freed memory instead of reader->js_buf + reader->js_used when an invalid JSON string spans buffers. This issue is fixed in version 9.2.0844.
🎖@cveNotify
GitHub
patch 9.2.0844: [security]: use-after-free on json decode error · vim/vim@f812629
Problem: [security]: use-after-free on json decode error
(@tdjackey)
Solution: Report the position from the current reader
(Matsumoto Yasuhiro)
json_decode_item() caches &...
(@tdjackey)
Solution: Report the position from the current reader
(Matsumoto Yasuhiro)
json_decode_item() caches &...
🚨 CVE-2026-73072
Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.
🎖@cveNotify
Vim is an open source, command line text editor. Prior to 9.2.0846, set_sofo() in src/spellfile.c reuses sl_sal_first[] without resetting values left by set_sal_first(), so a crafted spell file containing an SN_SAL section before an SN_SOFO section causes under-counted mapping lists and attacker-influenced writes beyond a heap allocation. This issue is fixed in version 9.2.0846.
🎖@cveNotify
GitHub
patch 9.2.0846: [security]: heap buffer overflow in set_sofo() · vim/vim@05c41c9
Problem: [security]: heap buffer overflow in set_sofo()
(Yazan Balawneh)
Solution: Reset sl_sal_first (Yasuhiro Matsumoto).
A crafted spell file with an empty SN_SAL section before an S...
(Yazan Balawneh)
Solution: Reset sl_sal_first (Yasuhiro Matsumoto).
A crafted spell file with an empty SN_SAL section before an S...
🚨 CVE-2026-73074
Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.
🎖@cveNotify
Vim is an open source, command line text editor. Prior to 9.2.0841, prop_add_one() in src/textprop.c uses the proplen value from get_text_props() to increment a uint16_t property count beyond 0xffff, wrapping the count to zero and copying existing text-property records into a heap allocation sized for none of them. This issue is fixed in version 9.2.0841.
🎖@cveNotify
GitHub
patch 9.2.0841: [security]: heap overflow when adding > 65535 text pr… · vim/vim@a9336b4
…operties
Problem: [security]: heap overflow when adding > 65535 text properties
(Wang1rrr).
Solution: Verify that the number of text properties falls within the
limit ...
Problem: [security]: heap overflow when adding > 65535 text properties
(Wang1rrr).
Solution: Verify that the number of text properties falls within the
limit ...
🚨 CVE-2026-73075
Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, indexing before the screen array instead of accounting for w_popup_topoff and causing an out-of-bounds read and conditional write. This issue is fixed in version 9.2.0843.
🎖@cveNotify
Vim is an open source, command line text editor. From 9.2.0469 until 9.2.0843, popup_mark_opacity_zindex() in src/popupwin.c can use a negative w_winrow for a text-property-anchored popup with clipwindow and opacity, indexing before the screen array instead of accounting for w_popup_topoff and causing an out-of-bounds read and conditional write. This issue is fixed in version 9.2.0843.
🎖@cveNotify
GitHub
Out-of-bounds Access in Popup Opacity Handling in Vim >= 9.2.0469 && Vim < 9.2.0843
Out-of-bounds Access in Popup Opacity Handling in Vim >= 9.2.0469 && Vim < 9.2.0843
==========================================================
Date: 23.07.2026
Severity: Medium
...
==========================================================
Date: 23.07.2026
Severity: Medium
...
🚨 CVE-2026-73076
Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.
🎖@cveNotify
Vim is an open source, command line text editor. Prior to 9.2.0847, runtime/autoload/vimball.vim allows a crafted vimball member named .VimballRecord to overwrite the installation record with attacker-chosen commands. When vimball#RmVimball() later processes the matching record entry, the stored Ex commands, including operating-system commands invoked through :!, execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0847.
🎖@cveNotify
GitHub
patch 9.2.0847: [security]: vimball: code execution via .VimballRecor… · vim/vim@581a2f3
…d file
Problem: [security]: vimball: code execution via .VimballRecord file
(tdjackey)
Solution: Forbid arbitrary commands, fix broken directory deletion code,
refactor code
...
Problem: [security]: vimball: code execution via .VimballRecord file
(tdjackey)
Solution: Forbid arbitrary commands, fix broken directory deletion code,
refactor code
...
🚨 CVE-2026-73077
Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.
🎖@cveNotify
Vim is an open source, command line text editor. Prior to 9.2.0839, the runtime/ftplugin/sh.vim, runtime/ftplugin/zsh.vim, and runtime/ftplugin/ps1.vim filetype plugins pass attacker-controlled Visual-mode selections from K through keywordprg commands without safely separating shell arguments. fnameescape() and PATH_ESC_CHARS do not neutralize shell metacharacters before ShKeywordPrg, ZshKeywordPrg, or GetHelp invokes bash, zsh, or PowerShell, allowing arbitrary operating-system commands to execute with the privileges of the user running Vim. This issue is fixed in version 9.2.0839.
🎖@cveNotify
GitHub
patch 9.2.0839: [security]: arbitrary code execution via keyword lookup · vim/vim@c5a82fe
Problem: [security]: arbitrary code execution via keyword lookup in
sh.vim, zsh.vim and ps1.vim filetype plugin
(manus-use)
Solution: For powershell, quote the commands using s...
sh.vim, zsh.vim and ps1.vim filetype plugin
(manus-use)
Solution: For powershell, quote the commands using s...
🚨 CVE-2026-73078
Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.
🎖@cveNotify
Vim is an open source, command line text editor. Prior to 9.2.0840, runtime/plugin/netrwPlugin.vim loads netrw and runtime/pack/dist/opt/netrw/autoload/netrw.vim constructs Bookmarks, History, and Targets menu entries by interpolating attacker-controlled directory paths into executed :menu commands. s:NetrwBookmarkMenu(), s:NetrwTgtMenu(), g:netrw_menu_escape, EX_TRLBAR, and netrw#MakeTgt() fail to neutralize the | command separator or single quotes at five construction sites, allowing a crafted path browsed or bookmarked in GUI Vim to execute arbitrary Ex and operating-system commands. This issue is fixed in version 9.2.0840.
🎖@cveNotify
GitHub
patch 9.2.0840: [security]: code injection in netrw via bookmarks · vim/vim@29c6fd0
Problem: [security]: code injection in netrw via bookmarks and history
(David Carliez)
Solution: Escape the '|' explicitly (Yasuhiro Matsumoto)
The bookmark and history ...
(David Carliez)
Solution: Escape the '|' explicitly (Yasuhiro Matsumoto)
The bookmark and history ...
🚨 CVE-2026-73080
SeaweedFS is a distributed storage system. Prior to 4.24, VolumeServer.FetchAndWriteNeedle in weed/server/volume_grpc_remote.go fetches a caller-supplied remote endpoint through weed/remote_storage/s3/s3_storage_client.go and writes the response into a needle. The RPC performs no authentication and no target validation, allowing anyone who can reach a volume server's gRPC port to cause requests to arbitrary hosts, including loopback, link-local, RFC 1918, and cloud metadata endpoints such as 169.254.169.254, and read the response. On cloud deployments, this can disclose instance metadata and IAM credentials and reach otherwise unexposed internal services. The volume server gRPC plane is unauthenticated by default, and configuring documented JWT signing keys does not protect this RPC. This issue is fixed in version 4.24.
🎖@cveNotify
SeaweedFS is a distributed storage system. Prior to 4.24, VolumeServer.FetchAndWriteNeedle in weed/server/volume_grpc_remote.go fetches a caller-supplied remote endpoint through weed/remote_storage/s3/s3_storage_client.go and writes the response into a needle. The RPC performs no authentication and no target validation, allowing anyone who can reach a volume server's gRPC port to cause requests to arbitrary hosts, including loopback, link-local, RFC 1918, and cloud metadata endpoints such as 169.254.169.254, and read the response. On cloud deployments, this can disclose instance metadata and IAM credentials and reach otherwise unexposed internal services. The volume server gRPC plane is unauthenticated by default, and configuring documented JWT signing keys does not protect this RPC. This issue is fixed in version 4.24.
🎖@cveNotify
GitHub
volume: gate FetchAndWriteNeedle behind admin auth and refuse interna… · seaweedfs/seaweedfs@69da20b
…l endpoints (#9441)
volume: require admin auth and refuse loopback endpoints in FetchAndWriteNeedle
Gate the RPC behind checkGrpcAdminAuth for parity with the rest of the
destructive volume-serv...
volume: require admin auth and refuse loopback endpoints in FetchAndWriteNeedle
Gate the RPC behind checkGrpcAdminAuth for parity with the rest of the
destructive volume-serv...
🚨 CVE-2026-9214
Insufficient input validation vulnerability in the NETGEAR R7000 models
allows authenticated administrators connected to the local network to
make unauthorized modification to router software and functionality.
🎖@cveNotify
Insufficient input validation vulnerability in the NETGEAR R7000 models
allows authenticated administrators connected to the local network to
make unauthorized modification to router software and functionality.
🎖@cveNotify
NETGEAR
R7000 | Nighthawk AC1900 Smart WiFi Dual Band Gigabit Router
Find setup help, user guides, product information, firmware, and troubleshooting for your Nighthawk R7000 on our official NETGEAR Support site today.
🚨 CVE-2026-3324
Zohocorp ManageEngine Log360 versions 13000 through 13013 are vulnerable to authentication bypass on certain actions due to improper filter configuration.
🎖@cveNotify
Zohocorp ManageEngine Log360 versions 13000 through 13013 are vulnerable to authentication bypass on certain actions due to improper filter configuration.
🎖@cveNotify
ManageEngine Log360
ManageEngine Log360!