🚨 CVE-2026-18674
On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store and re-distribute those resources as belonging to another zone.
The result is a cross-zone isolation bypass: the holder of a single enrolled zone's credential can inject, attribute, and overwrite resources in another zone's namespace mesh-wide.
The root cause lives in Kuma's open-source KDS sync code, which Kong Mesh's control plane is built on.
🎖@cveNotify
On a Kong Mesh global control plane, resources received over the zone-to-global KDS sync are attributed using the in-band, sender-controlled ControlPlane.Identifier rather than the authenticated zone identity derived from the connection. Authenticated zones can have the global control plane store and re-distribute those resources as belonging to another zone.
The result is a cross-zone isolation bypass: the holder of a single enrolled zone's credential can inject, attribute, and overwrite resources in another zone's namespace mesh-wide.
The root cause lives in Kuma's open-source KDS sync code, which Kong Mesh's control plane is built on.
🎖@cveNotify
Kong Docs
Kong Mesh changelog - Kong Mesh | Kong Docs
Changelog for supported Kong Mesh versions.
🚨 CVE-2026-12553
HP has identified a potential vulnerability in HP Web Jetadmin (WJA) that may allow an unauthenticated actor to read from or write to arbitrary files through a DLL hijacking mechanism.
🎖@cveNotify
HP has identified a potential vulnerability in HP Web Jetadmin (WJA) that may allow an unauthenticated actor to read from or write to arbitrary files through a DLL hijacking mechanism.
🎖@cveNotify
🚨 CVE-2026-71878
Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass
🎖@cveNotify
Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass
🎖@cveNotify
GitHub
Setup wizard steps validate the wrong state, allowing steps to re-run after setup is complete · Issue #3115 · gbif/ipt
Each step in SetupAction is meant to be a one-time action that shouldn't do anything once its own piece of setup is already done. In practice, most of these methods guard on the wrong condition...
🚨 CVE-2026-71879
Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass
🎖@cveNotify
Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative control via authentication bypass
🎖@cveNotify
GitHub
Setup wizard steps validate the wrong state, allowing steps to re-run after setup is complete · Issue #3115 · gbif/ipt
Each step in SetupAction is meant to be a one-time action that shouldn't do anything once its own piece of setup is already done. In practice, most of these methods guard on the wrong condition...
🚨 CVE-2026-71880
Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to access server-side files and state via template injection
🎖@cveNotify
Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to access server-side files and state via template injection
🎖@cveNotify
GitHub
Remove FreeMarker `?interpret` from user-controlled content · Issue #3118 · gbif/ipt
Replace all usages with ?no_esc
🚨 CVE-2025-9210
Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via tampering with JWTs
🎖@cveNotify
Missing signature validation in JSON Web Tokens in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via tampering with JWTs
🎖@cveNotify
GitHub
Vulnerability-Disclosures/2026/MNDT-2026-0023.md at master · mandiant/Vulnerability-Disclosures
Contribute to mandiant/Vulnerability-Disclosures development by creating an account on GitHub.
🚨 CVE-2025-9211
Unescaped stored values in application security page in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via persistent cross-site scripting
🎖@cveNotify
Unescaped stored values in application security page in Otalio Ship Property Management System versions before 2.22.0 allows authenticated attackers to escalate privileges via persistent cross-site scripting
🎖@cveNotify
GitHub
Vulnerability-Disclosures/2026/MNDT-2026-0024.md at master · mandiant/Vulnerability-Disclosures
Contribute to mandiant/Vulnerability-Disclosures development by creating an account on GitHub.
🚨 CVE-2026-8810
On ARM platforms, a vulnerability in the architecture design of HDD Password could allow an attacker to retrieve HDD Password from UEFI variables.
🎖@cveNotify
On ARM platforms, a vulnerability in the architecture design of HDD Password could allow an attacker to retrieve HDD Password from UEFI variables.
🎖@cveNotify
Insyde Software
SA-2026005
🚨 CVE-2026-18371
HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users.
🎖@cveNotify
HTML injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated attacker to affect web user interface contents displayed to other users.
🎖@cveNotify
🚨 CVE-2026-18372
CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interface displayed to other vault users.
🎖@cveNotify
CSS injection vulnerability in M-Files Web before 26.8.16330.2 allows an authenticated vault administrator to inject arbitrary CSS, affecting the web user interface displayed to other vault users.
🎖@cveNotify
🚨 CVE-2024-13942
Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from external media (SPI NOR or NAND, EMMC or SD).
The code reads the header of the next-stage loader twice. The header contains hashes of the executable modules and is signed with a private key, the public part of which is verified against the SHA256 digest blown in the OTP.
The first read is only partial and contains only the hashes of the executable modules. The second is complete, including the header signature.
Although the header is verified based on the fully read data, the authenticity of the executable modules is checked against the partial data from the first read.
An attacker with physical access to a device containing RK3588s SoC can easily modify the next-stage loader data on-the-fly using a low-cost SD-card or SPI NOR/NAND or EMMC emulator. Even a simple ultra low-cost circuit comprising two memory chips (containing the same data but different headers - the original and the modified one) and a multiplexer can be used to carry out an attack.
This can lead to arbitrary code execution with the highest privileges available (EL3). This issue affects RK3588s: RK3588s SoC BootROM (secure) 350B20210512V100 and possibly others.
As remediation apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable https://www.rock-chips.com/a/en/products/RK35_Series/2022/0926/1660.html
🎖@cveNotify
Secure BootROM of RK3588s SoC is vulnerable to a time-of-check to time-of-use attack in case of booting from external media (SPI NOR or NAND, EMMC or SD).
The code reads the header of the next-stage loader twice. The header contains hashes of the executable modules and is signed with a private key, the public part of which is verified against the SHA256 digest blown in the OTP.
The first read is only partial and contains only the hashes of the executable modules. The second is complete, including the header signature.
Although the header is verified based on the fully read data, the authenticity of the executable modules is checked against the partial data from the first read.
An attacker with physical access to a device containing RK3588s SoC can easily modify the next-stage loader data on-the-fly using a low-cost SD-card or SPI NOR/NAND or EMMC emulator. Even a simple ultra low-cost circuit comprising two memory chips (containing the same data but different headers - the original and the modified one) and a multiplexer can be used to carry out an attack.
This can lead to arbitrary code execution with the highest privileges available (EL3). This issue affects RK3588s: RK3588s SoC BootROM (secure) 350B20210512V100 and possibly others.
As remediation apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable https://www.rock-chips.com/a/en/products/RK35_Series/2022/0926/1660.html
🎖@cveNotify
GitHub
Advisories/KLSA-00230-Rockchip-RK3588s-Secure-BootROM-TOCTOU-vulnerability.md at master · klsecservices/Advisories
Contribute to klsecservices/Advisories development by creating an account on GitHub.
🚨 CVE-2025-14600
An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account.
Apply patch from vendor https://vsdesk.ru/ . Versions 14.0402 and on have the patch.
🎖@cveNotify
An insecure deserialization vulnerability in vsDesk allows a remote attacker to gain unauthorized administrative access. By manipulating application configuration data, an attacker can force the system to authenticate against an arbitrary LDAP server and provision a new administrative account.
Apply patch from vendor https://vsdesk.ru/ . Versions 14.0402 and on have the patch.
🎖@cveNotify
GitHub
Advisories/KLSA-00296-Admin-Account-Takeover-via-Path-Traversal-in-vsDesk.md at master · klsecservices/Advisories
Contribute to klsecservices/Advisories development by creating an account on GitHub.
🚨 CVE-2025-14603
The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the application to become unresponsive.
Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.
🎖@cveNotify
The application component processes user-supplied parameters insecurely, passing them into SQL queries. This can enable blind SQL injection, potentially exposing database contents or causing the application to become unresponsive.
Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.
🎖@cveNotify
GitHub
Advisories/KLSA-00295-Blind-SQLi-via-User-Input-in-vsDesk.md at master · klsecservices/Advisories
Contribute to klsecservices/Advisories development by creating an account on GitHub.
🚨 CVE-2025-14602
The application generates uploaded file names using a weak and predictable method based on the request timestamp. This allows a remote attacker to accurately guess or brute-force the generated filename within a short time window. An attacker can successfully locate and access uploaded files, which can be used to facilitate further attacks.
Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.
🎖@cveNotify
The application generates uploaded file names using a weak and predictable method based on the request timestamp. This allows a remote attacker to accurately guess or brute-force the generated filename within a short time window. An attacker can successfully locate and access uploaded files, which can be used to facilitate further attacks.
Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.
🎖@cveNotify
GitHub
Advisories/KLSA-00294-Weak-File-Name-Generation-in-vsDesk.md at master · klsecservices/Advisories
Contribute to klsecservices/Advisories development by creating an account on GitHub.
🚨 CVE-2025-14601
An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insufficient input filtering. An attacker can exploit this flaw to disrupt web server operations, expose sensitive data, or potentially achieve full server compromise.
Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.
🎖@cveNotify
An OS command injection vulnerability in vsDesk allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands due to insufficient input filtering. An attacker can exploit this flaw to disrupt web server operations, expose sensitive data, or potentially achieve full server compromise.
Apply patch from vendor https://vsdesk.ru/ . Versions 14.0101 and on have the patch.
🎖@cveNotify
GitHub
Advisories/KLSA-00343-vsDesk-Task-Scheduler-OS-Command-Injection.md at master · klsecservices/Advisories
Contribute to klsecservices/Advisories development by creating an account on GitHub.
🚨 CVE-2026-2334
An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to a lack of server-side validation. This allows the upload of an arbitrary file, which can lead to Remote Code Execution (RCE) within the context of the web application.
Apply patch from vendor https://vsdesk.ru/ . Versions 14.0402 and on have the patch.
🎖@cveNotify
An issue was discovered in vsDesk v14.0101. An authenticated attacker with administrative privileges can bypass client-side file validation in the "Import via CSV" component due to a lack of server-side validation. This allows the upload of an arbitrary file, which can lead to Remote Code Execution (RCE) within the context of the web application.
Apply patch from vendor https://vsdesk.ru/ . Versions 14.0402 and on have the patch.
🎖@cveNotify
GitHub
Advisories/KLSA-00415-Missing-Server-Side-File-Extension-Validation-in-vsDesk.md at master · klsecservices/Advisories
Contribute to klsecservices/Advisories development by creating an account on GitHub.
🚨 CVE-2026-18349
Improper protection against voltage and clock glitches vulnerability in Microchip SAMA5D4 allows Hardware Fault Injection.
This issue affects SAMA5D4.
🎖@cveNotify
Improper protection against voltage and clock glitches vulnerability in Microchip SAMA5D4 allows Hardware Fault Injection.
This issue affects SAMA5D4.
🎖@cveNotify
🚨 CVE-2026-79718
Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution.
🎖@cveNotify
Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution.
🎖@cveNotify
GitHub
Update view.js · lutzroeder/netron@cd14bad
Visualizer for neural network, deep learning and machine learning models - Update view.js · lutzroeder/netron@cd14bad
🚨 CVE-2026-79719
Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution.
🎖@cveNotify
Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution.
🎖@cveNotify
GitHub
Update view.js · lutzroeder/netron@cd14bad
Visualizer for neural network, deep learning and machine learning models - Update view.js · lutzroeder/netron@cd14bad
🚨 CVE-2026-79720
Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution.
🎖@cveNotify
Reflected XSS in Netron versions <=9.1.2 on desktop application through unsanitized node names allows an attacker to hide certain nodes, perform port scanning or abuse a Chrome n-day to achieve Remote Code Execution.
🎖@cveNotify
GitHub
Update view.js · lutzroeder/netron@cd14bad
Visualizer for neural network, deep learning and machine learning models - Update view.js · lutzroeder/netron@cd14bad
🚨 CVE-2026-62904
Incorrect authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
🎖@cveNotify
Incorrect authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
🎖@cveNotify