🚨 CVE-2026-66377
An unauthenticated user may access restricted repository information under specific conditions.

🎖@cveNotify

🚨 CVE-2026-66378
An authenticated user without repository read permission may access private NuGet metadata under specific conditions.

🎖@cveNotify

🚨 CVE-2026-66379
An authenticated user may view private Puppet module metadata without repository read access.

🎖@cveNotify

🚨 CVE-2026-66380
An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.

🎖@cveNotify

🚨 CVE-2026-66381
A repository reader with cache-deploy permission may access content outside a configured upstream path under specific conditions.

🎖@cveNotify

🚨 CVE-2026-66382
An authenticated user may write files outside the intended Artifactory work directory under specific conditions.

🎖@cveNotify

🚨 CVE-2026-68752
A Project Resource Manager may gain broader administrative privileges under specific conditions.

🎖@cveNotify

🚨 CVE-2026-68753
An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.

🎖@cveNotify

🚨 CVE-2026-68754
A repository publisher without delete permission may modify protected package content under specific conditions.

🎖@cveNotify

🚨 CVE-2026-68755
A bundle writer may create misleading release promotion information under specific conditions.

🎖@cveNotify

🚨 CVE-2026-68756
A party with write access to stored session data may affect JFrog Artifactory under specific conditions.

🎖@cveNotify

🚨 CVE-2026-68757
A user with access to a valid SAML response may impersonate another user under specific conditions.

🎖@cveNotify

🚨 CVE-2026-68760
An unauthenticated user may bypass authentication under specific cache conditions.

🎖@cveNotify

🚨 CVE-2026-68759
A holder of a valid integration credential may impersonate other users under specific conditions.

🎖@cveNotify

🚨 CVE-2026-84303
gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, the xDS RBAC HTTP filter in internal/xds/httpfilter/rbac/rbac.go does not lowercase header matcher names in normalizeHeaderMatcher even though incoming metadata keys are lowercase. A DENY policy using a mixed-case name such as X-Role or User-Agent therefore does not match and fails open, allowing requests that should be rejected. The same case mismatch permits :Scheme or Grpc-Status to evade gRFC A41 validation and prevents Host from being rewritten to :authority. This issue is fixed in version 1.83.1.

🎖@cveNotify

🚨 CVE-2026-84361
Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and 2.10.3, a malicious dependency package from a custom Composer repository or an untrusted composer.lock file could set source.type to perforce and source.url to an rsh: or jsh: P4PORT value. When the Perforce p4 client was installed and Composer installed the package from source through composer install or composer update, including --prefer-source, Composer\Util\Perforce passed the address to p4 without validation, causing p4 to run a local command with the privileges of the user or CI account. Packagist.org does not permit Perforce source metadata. This issue is fixed in versions 2.2.30 and 2.10.3.

🎖@cveNotify

🚨 CVE-2026-84372
Predis is a flexible and feature-complete Redis and Valkey client for PHP. From version 3.0.0-RC1 until version 3.3.0, pipeline handling on aggregate cluster and replication connections reparses an already serialized RESP buffer in AbstractAggregateConnection::write() by splitting it with explode("\r\n") instead of honoring RESP length prefixes. Attacker-controlled keys or values containing CRLF sequences can therefore be interpreted by Command::deserializeCommand() as additional commands. On cluster connections, ClusterStrategy::getFakeKey() can route injected keyless commands using the literal fake key value "key", permitting operations such as shard-wide cache deletion, targeted data modification, data reads, or node disruption. On replication connections, malformed reparsing can throw an uncaught exception and repeatedly terminate affected requests. Only pipeline() reaches this vulnerable path; transaction() and MULTI are not affected. This issue is fixed in version 3.3.0.

🎖@cveNotify

🚨 CVE-2026-84642
The values of the mail.allowed_attachment_hostnames advanced config setting were used in a regular expression without escaping. For some possible valid hostnames, this could allow certain unintended hostnames to also match and serve remote attachments. This vulnerability was fixed in Thunderbird 155 and Thunderbird 153.2.

🎖@cveNotify

🚨 CVE-2026-81928
Net::DNS versions before 1.57 for Perl allow memory exhaustion via unbounded recursion in sig_data when re-encoding a message with a misplaced TSIG record.

sig_data signs a message by re-encoding it, and removes TSIG records only from the additional section. A TSIG decoded into the answer or authority section survives that step and is signed again, so encoding re-enters sig_data with no termination condition. Decoding does not reject such a message: a TSIG that is not the last record on the wire raises "misplaced or corrupt TSIG", but the error is caught, reported as a warning, and the record is left in the packet. RFC 8945 section 5.2 requires the message to be dropped.

The recursion is reached only when the decoded TSIG carries an empty MAC, since a MAC recovered from the wire short-circuits the signing step. It is reached only from code that re-encodes a message it decoded, such as a forwarder or a proxy. A decoded message that is never re-encoded is unaffected. Message direction does not matter: a query reaches the same path as a response.

Each cycle re-encodes the whole message, so fewer than 100 bytes on the wire exhaust available memory and terminate the process.

🎖@cveNotify

🚨 CVE-2026-81164
Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5.

🎖@cveNotify

🚨 CVE-2026-81205
Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') vulnerability in Drupal LDAP / Active Directory Integration allows LDAP Injection. This issue affects LDAP / Active Directory Integration versions: from 0.0.0 to 2.2.1.

🎖@cveNotify