ZoneMinder versions 1.37.0 before 1.38.0 contain a path traversal vulnerability in the files view that allows authenticated users to read arbitrary files. The path parameter is not properly validated before being passed to output_file, enabling attackers with Events view permission to access sensitive files like configuration files containing database credentials.
CVE-2026-101277 is a medium severity vulnerability in Trusted Domain Project OpenDKIM up to version 2.11.0. It involves the dkim_process_set function in the dkim.c file of the Tag Tokenizer component, where manipulation can cause the use of a less trusted source. The vulnerability can be exploited remotely without authentication, and public exploit code is available. The vendor has not responded to the disclosure, and no official patch information is provided.
OpenSSL contains a vulnerability in its handling of undersized DTLS 1.2 AEAD records before authentication, which can cause a denial of service (DoS). This issue allows an attacker to terminate an established DTLS 1.2 association by sending a single unauthenticated datagram. The vulnerability affects multiple Ubuntu OpenSSL package versions and has a CVSS score of 5.3, indicating a low severity level.
Issue summary: The OpenSSL QUIC server, when configured to not preform address validation, can be forced to count incoming packets multiple times in its unvalidated credit computation, leading to a violation of the RFC 9000 unvalidated connection amplification limit of 3 times the amount of data received. Impact summary: A remote attacker able to spoof packets to a server using the OpenSSL QUIC implementation might use the server for an amplification of a DDoS attack. CWE: CWE-440: Expected Behavior Violation Description: OpenSSL's QUIC stack, when operating as a server, enforces client address validation (RFC 9000, Section 8), to confirm the peer address is not used for a traffic amplification attack. If this feature is disabled on the server, the QUIC stack limits the amount of server data that can be sent to 3 times the amount of data received from the peer address, until such time as the TLS handshake is completed. The OpenSSL QUIC server, when operating in non-validation mode, adds the length of the whole datagram received to the unvalidated credit limit when processing each QUIC packet in the datagram. A remote peer may, after establishing a connection with an initial client hello frame, send a subsequent datagram containing multiple QUIC packets, leading the server to account the entire datagram length for each packet in the datagram, resulting in the server believing that the peer has sent more data than it actually has, thereby violating the 3x amplification limit mandated by the RFC. FIPS impact: no As the QUIC stack lives outside the FIPS module boundary, no FIPS modules are affected by this CVE.
A timing side-channel vulnerability exists in OpenSSL's SM2 signature generation, where non-constant-time arithmetic on secret values may allow attackers to infer sensitive information. This issue affects multiple OpenSSL versions used in various Ubuntu LTS releases. The vulnerability has a low CVSS score of 3.7 and does not impact integrity or availability. Official patches are available from Ubuntu to address this issue.
A vulnerability in the OpenSSL QUIC stack used by Node.js allows a remote peer to bypass connection-level flow control for streams. This can lead to excessive memory allocation on the local system, potentially up to 100MB per connection instead of the intended 768 KiB. Exploitation requires specific conditions involving multiple streams and data patterns. The OpenSSL FIPS module is not affected as the QUIC implementation lies outside its boundary. The issue has a CVSS score of 5.3 (low severity) and affects multiple specific Node.js versions. A patch is available to address this vulnerability.
A vulnerability in OpenSSL's CMP client allows a NULL pointer dereference when requesting certificate revocation using a PKCS#10 CSR. This can cause the client to crash and result in a denial of service. The issue does not affect clients that identify certificates by certificate or issuer and serial number, and no FIPS modules are impacted. A patch is available to address this issue.
A timing and cache side-channel vulnerability affects SM2 private key operations on ARM64 and RISC-V platforms in certain OpenSSL versions used by Node.js. The scalar point multiplication implementation is not constant-time, which could allow attackers measuring timing or cache patterns during SM2 signing or decryption to gain information about secret scalars. This vulnerability impacts OpenSSL versions 4.0, 3.6, 3.5, and 3.4 but does not affect versions 3.0, 1.1.1, or 1.0.2. Fixes have been released in OpenSSL 4.0.3, 3.6.5, 3.5.9, and 3.4.8. The CVSS score is 3.7, indicating low severity.
A timing side-channel vulnerability exists in OpenSSL's generic elliptic-curve scalar multiplication used for ECDSA and SM2 signature operations on non-NIST curves without dedicated constant-time implementations, such as brainpoolP384r1. This vulnerability can leak secret nonce information through timing variations, potentially allowing private key recovery after many signature observations. NIST curves with constant-time implementations are not affected. The vulnerability has a low severity score and does not impact FIPS modules. Fixes are available across multiple Ubuntu LTS releases.
A vulnerability in Node.js TLS server occurs when SSL_set_SSL_CTX() is called to switch a SSL_CTX during a handshake and the new context has more provider signature algorithms than the original. This can cause out-of-bounds memory access leading to a denial of service. The issue affects only non-default configurations where SSL_CTX is switched mid-handshake with differing signature algorithms. FIPS modules are not impacted. The severity is low due to limited exploitation scope and the need for specific application behavior.
A vulnerability in the Node.js OpenSSL QUIC stack allows a remote attacker to flood the local QUIC implementation with NEW_CONNECTION_ID frames by bypassing limits on connection IDs. This leads to excessive memory allocation (~400MB) due to improper handling of RETIRE_CONNECTION_ID frames, violating RFC 9000 requirements. The flaw affects multiple Node.js versions and has a CVSS score of 7.5. A patch is available to address this issue.
CVE-2026-94953 is a stack-based buffer overflow vulnerability in the web management interface of TOTOLINK N150RT (NTR150) firmware version 3.4.0-B20201030. The flaw is triggered via the /boafrm/formAjaxSet route using the topicurl=setting/setWiFiRepeaterConfig branch and the ApCliWEPKey field. This vulnerability allows an attacker with low privileges and no user interaction to potentially execute arbitrary code, resulting in high impact to confidentiality, integrity, and availability.
metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference (IDOR) in the MCP transport session dispatch. The session store (getSession in session-lifetime-manager.ts) is keyed only by the client-supplied mcp-session-id header with no owner, namespace, or endpoint binding, and the per-endpoint authorization middleware validates only the URL endpoint's owner, never the session. An attacker who supplies another tenant's session id " obtained without authentication from GET /metamcp/health/sessions, which discloses active session IDs and namespace UUIDs " can list and execute the victim tenant's private MCP tools and exfiltrate their data using the victim's forwarded credentials.
A SQL injection vulnerability exists in bytebase dbhub v1.2.0 within the /utils/sql-parser.ts component. This flaw allows attackers to execute crafted SQL statements that can access sensitive database information. The vulnerability has a critical severity with a CVSS score of 9.1.
mbailey VoiceMode versions up to and including 8.10.1 contain an OS command injection vulnerability. This occurs because the update_config MCP tool and the "voicemode config set" CLI command write user-supplied input into the ~/.voicemode/voicemode.env file without proper shell escaping. The vulnerability has a CVSS score of 6.3, indicating a medium severity level.
A stack-based buffer overflow vulnerability exists in the web management interface of TOTOLINK N150RT (NTR150) firmware V3.4.0-B20201030. It is reachable through the route /boafrm/formPortFw (port-forwarding configuration handler) and is triggered by the ip_subnet and fw_ip request parameters during the rule-addition flow.
KitchenAsty versions up to 0.3.0 contain an Insecure Direct Object Reference (IDOR) vulnerability in the reservations API. The GET /api/reservations/:id endpoint authenticates users but does not verify that the authenticated user owns the requested reservation, allowing unauthorized access to reservation data. This vulnerability has a medium severity rating with a CVSS score of 4.3.
CVE-2026-67993 is a high-severity vulnerability in the basecamp/upright project involving a login cross-site request forgery (CSRF) issue in the static credentials callback. This flaw allows an attacker to potentially perform unauthorized actions by exploiting the CSRF weakness during login. The vulnerability has a CVSS score of 8.8, indicating a significant impact on confidentiality, integrity, and availability. No affected versions or patches are explicitly stated, and there are no known exploits in the wild at this time.
CVE-2026-67987 is a high-severity vulnerability affecting the crmne/ruby_llm project at a specific commit. It involves polynomial-time regular expression denial-of-service (ReDoS) conditions in the think-tag response parsing on Ruby 3.1.x. Malicious or anomalous model responses with many unterminated <think> tags can cause excessive CPU consumption and delay chat-completion processing.
CVE-2026-39117 is a critical remote code execution vulnerability affecting AltumCode 66Uptime versions before 54.0.0 and the 66Uptime ping-servers plugin before 2.0.0. The flaw allows an unauthenticated attacker to execute arbitrary code via the index.php file. This vulnerability has a CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability. No official patch or remediation details are provided in the input data.