🚨 CVE-2026-75604
Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing incremental-cache paths. In packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/next/src/server/lib/incremental-cache/file-system-cache.ts, a remote request can supply encoded Windows path separators that traverse outside the intended cache root and expose private build data, including the server-reference-manifest encryption key. Disclosure of that key can enable remote code execution in the affected application. This issue is fixed in versions 15.5.24 and 16.3.3.
🎖@cveNotify
Next.js is a React framework for building full-stack web applications. From 13.4.0 until 15.5.24 and 16.3.3, Next.js applications using Pages Router or App Router without Cache Components on Windows-hosted servers do not consistently escape backslashes in route segments before constructing incremental-cache paths. In packages/next/src/shared/lib/router/utils/escape-path-delimiters.ts and packages/next/src/server/lib/incremental-cache/file-system-cache.ts, a remote request can supply encoded Windows path separators that traverse outside the intended cache root and expose private build data, including the server-reference-manifest encryption key. Disclosure of that key can enable remote code execution in the affected application. This issue is fixed in versions 15.5.24 and 16.3.3.
🎖@cveNotify
GitHub
[16.3.x] Fix ISR misses with backslashes in segments when deployed on… · vercel/next.js@968b9fc
… Windows
https://github.com/vercel/next-js-mirror/pull/156
https://github.com/vercel/next-js-mirror/pull/156
🚨 CVE-2026-16647
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.
🎖@cveNotify
Authentication Bypass Using an Alternate Path or Channel vulnerability in Drupal Disable Login Page allows Functionality Bypass. This issue affects Disable Login Page versions: from 0.0.0 to 1.1.4.
🎖@cveNotify
Drupal.org
Disable Login Page - Moderately critical - Access bypass - SA-CONTRIB-2026-111
This module enables you to disable access to the /user/login form unless a secret key is provided. The module does not invalidate the relevant caches when login page access restrictions are enabled. As a result, previously cached login page responses may…
🚨 CVE-2026-84653
Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance configuration page, allowing attackers with Overall/Manage permission to modify Appearance configuration options they should not have access to.
🎖@cveNotify
Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance configuration page, allowing attackers with Overall/Manage permission to modify Appearance configuration options they should not have access to.
🎖@cveNotify
Jenkins Security Advisory 2026-09-02
Jenkins – an open source automation server which enables developers around the world to reliably build, test, and deploy their software
🚨 CVE-2026-84666
Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, allowing attackers to redirect history storage to an attacker-specified directory and modify history recording settings.
🎖@cveNotify
Jenkins Job Configuration History Plugin 1367.vc8fa_b_15101dc and earlier allows overwriting the plugin's history recording configuration through Stapler data binding, allowing attackers to redirect history storage to an attacker-specified directory and modify history recording settings.
🎖@cveNotify
Jenkins Security Advisory 2026-09-02
Jenkins – an open source automation server which enables developers around the world to reliably build, test, and deploy their software
🚨 CVE-2023-20576
Insufficient Verification of Data Authenticity in AGESA™ may allow an attacker to update SPI ROM data potentially resulting in denial of service or privilege escalation.
🎖@cveNotify
Insufficient Verification of Data Authenticity in AGESA™ may allow an attacker to update SPI ROM data potentially resulting in denial of service or privilege escalation.
🎖@cveNotify
AMD
GPU Memory Leaks
🚨 CVE-2023-20577
A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary code execution.
🎖@cveNotify
A heap overflow in SMM module may allow an attacker with access to a second vulnerability that enables writing to SPI flash, potentially resulting in arbitrary code execution.
🎖@cveNotify
AMD
GPU Memory Leaks
🚨 CVE-2026-85169
n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler. $fromAI resolved a caller-supplied placeholder name without requiring it to be an own property and admitted reserved keys; against a primitive input value it returned a live host-prototype reference. An attacker with workflow-build privilege can walk the prototype chain to the Function constructor and compile/execute arbitrary code in the main n8n process, leading to remote code execution.
🎖@cveNotify
n8n versions before 1.123.73, 2.35.4, and 2.36.2 contain an expression sandbox escape in the $fromAI handler. $fromAI resolved a caller-supplied placeholder name without requiring it to be an own property and admitted reserved keys; against a primitive input value it returned a live host-prototype reference. An attacker with workflow-build privilege can walk the prototype chain to the Function constructor and compile/execute arbitrary code in the main n8n process, leading to remote code execution.
🎖@cveNotify
GitHub
Expression Sandbox Escape via $fromAI Prototype Leak Leads to Host RCE
## Impact
`$fromAI` resolved a caller-supplied placeholder name without requiring it to be an own property, and admitted reserved keys, against a primitive input value this returned a live host-pr...
`$fromAI` resolved a caller-supplied placeholder name without requiring it to be an own property, and admitted reserved keys, against a primitive input value this returned a live host-pr...
🚨 CVE-2026-85458
Divide-by-zero in Xpdf 4.06 (and earlier), when a glyph in a Type 3 font has a zero height.
🎖@cveNotify
Divide-by-zero in Xpdf 4.06 (and earlier), when a glyph in a Type 3 font has a zero height.
🎖@cveNotify
🚨 CVE-2026-65818
Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
Server-side request forgery (ssrf) in Power Automate allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
🚨 CVE-2026-70178
Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privileges over a network.
🎖@cveNotify
🚨 CVE-2026-70352
Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network.
🎖@cveNotify
Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network.
🎖@cveNotify
🚨 CVE-2026-80098
Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network.
🎖@cveNotify
Improper verification of cryptographic signature in Copilot Studio allows an unauthorized attacker to elevate privileges over a network.
🎖@cveNotify
🚨 CVE-2026-83711
Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.
🎖@cveNotify
Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.
🎖@cveNotify
🚨 CVE-2026-49509
Out-of-bounds read vulnerability in Samsung Opensource Escargot allows Overread Buffers.
This issue affects Escargot: 25648aef19187b3f87f4d9420b8d761453ad4630.
🎖@cveNotify
Out-of-bounds read vulnerability in Samsung Opensource Escargot allows Overread Buffers.
This issue affects Escargot: 25648aef19187b3f87f4d9420b8d761453ad4630.
🎖@cveNotify
GitHub
stb_image: don't deal with fractional ratios by mmaciola · Pull Request #604 · Samsung/rlottie
Apply fix from stb 2.27
🚨 CVE-2026-67397
Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root.
🎖@cveNotify
Path traversal in Plesk 18.0.79.9 and earlier and 18.0.80 through 18.0.80.5 allows local users to execute arbitrary code as root.
🎖@cveNotify
Plesk
Vulnerability CVE-2026-67397: Arbitrary code execution as root in Plesk
A security vulnerability was discovered in Plesk that could allow a Plesk user to execute arbitrary code as root on the server. This security vulnerability has been identified as CVE-2026-67397.Aff...
🚨 CVE-2026-67398
Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.8, from 9.0.0 before 9.0.8, all other EOL versions from 4.5.0. The vulnerability allows an unauthenticated user to get WHMCS customer's data via 2Checkout payment gateway's endpoint under specific conditions.
🎖@cveNotify
Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.8, from 9.0.0 before 9.0.8, all other EOL versions from 4.5.0. The vulnerability allows an unauthenticated user to get WHMCS customer's data via 2Checkout payment gateway's endpoint under specific conditions.
🎖@cveNotify
🚨 CVE-2026-67402
An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerability affects installations where CSF Messenger v3 and its HTTPS mode are enabled. WebPros addressed the vulnerability in version 16.31.
🎖@cveNotify
An insecure Apache configuration in ConfigServer Security & Firewall maps /usr/bin as CGI programs through the Messenger v3 HTTPS virtual host. A remote unauthenticated attacker whose address is blocked can request a mapped executable and run arbitrary commands as the Apache user. The vulnerability affects installations where CSF Messenger v3 and its HTTPS mode are enabled. WebPros addressed the vulnerability in version 16.31.
🎖@cveNotify
cPanel
Security: CSF Security Release - September 3rd, 2026
SituationA vulnerability was found in the MESSENGER service in the ConfigServer Firewall (CSF) software which could allow for unauthorized code execution.This has a public CVE record listed with fu...
🚨 CVE-2026-75754
Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorized user to obtain the encryption key via an HTTP request, causing a local service to enable SSH on port 2222. The attacker can then log in with the hardcode credentials to obtain a root shell, enabling direct reading, writing, and deletion of data on ASUS Control Center, as well as remote control of all servers, PCs, and workstations within the company.
Refer to the 'Security Update for ASUS Control Center' section on the ASUS Security Advisory for more information.
🎖@cveNotify
Missing Authentication for Critical Function, Server-Side Request Forgery (SSRF), and Use of Hard-coded Credentials in ASUS Control Center allow an unauthorized user to obtain the encryption key via an HTTP request, causing a local service to enable SSH on port 2222. The attacker can then log in with the hardcode credentials to obtain a root shell, enabling direct reading, writing, and deletion of data on ASUS Control Center, as well as remote control of all servers, PCs, and workstations within the company.
Refer to the 'Security Update for ASUS Control Center' section on the ASUS Security Advisory for more information.
🎖@cveNotify
Asus
ASUS Security Advisory | Latest Vulnerability Update
Stay updated with ASUS security advisories, firmware patches, and vulnerability reports. Learn how to protect your devices and report issues.
🚨 CVE-2026-85504
FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses.
🎖@cveNotify
FreeIPMI before 1.6.19 has a stack-based buffer overflow in _ipmi_sel_oem_fujitsu_get_sel_entry_long_text in libfreeipmi/sel/ipmi-sel-string-fujitsu-irmc-common.c via malformed Fujitsu SEL long-text responses.
🎖@cveNotify
🚨 CVE-2026-62928
XING CPTrans-ME-X contains an OS Command Injection (CWE-78). Unauthenticated OS command may be injected.
🎖@cveNotify
XING CPTrans-ME-X contains an OS Command Injection (CWE-78). Unauthenticated OS command may be injected.
🎖@cveNotify
JOYSOUND.Biz | 業務用カラオケ機器（導入・レンタル）
通信アダプタ CPTrans-ME-X | 業務用カラオケ機器（導入・レンタル）| JOYSOUND.Biz
JOYSOUND 通信アダプタの製品ページです。カラオケ導入ご検討の方は是非ご覧下さい。
🚨 CVE-2026-66840
XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497). Sensitive system information may be leaked.
🎖@cveNotify
XING CPTrans-ME-X contains an Exposure of Sensitive System Information to an Unauthorized Control Sphere (CWE-497). Sensitive system information may be leaked.
🎖@cveNotify
JOYSOUND.Biz | 業務用カラオケ機器（導入・レンタル）
通信アダプタ CPTrans-ME-X | 業務用カラオケ機器（導入・レンタル）| JOYSOUND.Biz
JOYSOUND 通信アダプタの製品ページです。カラオケ導入ご検討の方は是非ご覧下さい。