CVE-2026-104002 is a vulnerability in the data masking utility of Powertools for AWS Lambda (Python) that causes fail-open error handling. This flaw can allow unauthorized actors to access sensitive field values that should have been masked. The issue affects versions from 3.6.0 through 3.34.0 inclusive. AWS has issued a security bulletin to raise awareness of this vulnerability.
CVE-2026-71448 is an insecure default initialization of resource vulnerability in Johnson Controls EasyIO FS32 that allows authentication abuse. It affects versions before 3.0b63. The vulnerability has a medium severity with a CVSS 4.0 score of 5.6. A patch is available for this issue. The product is a cloud service, so the vendor manages remediation for the hosted service.
CVE-2026-71454 is a medium severity cross-site scripting (XSS) vulnerability affecting CAPEC-63 versions before 3.0b63. It involves improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The vulnerability has a CVSS 4.0 base score of 5.8, indicating moderate impact. No known exploits are reported in the wild, and no official patch or remediation guidance is currently available.
CVE-2026-71453 is a medium severity vulnerability in Johnson Controls EasyIO FS32 prior to version 3.0b63. It involves external control of file name or path, enabling a traversal attack. The vulnerability allows an attacker with high privileges to potentially manipulate file paths externally. A patch is available, and the product is a cloud service, so vendor-managed remediation is expected.
PictShare versions before 3.7.1 have an information disclosure vulnerability in the API::info() endpoint that allows unauthenticated attackers to access sensitive metadata including the secret delete_code and uploader details. This enables attackers to delete arbitrary files and exposes uploader IP, User Agent, remote port, and file hash, compromising content integrity, availability, and uploader privacy.
An OS Command Injection vulnerability (CWE-78) exists in Johnson Controls EasyIO FS32 versions before 3.0b63. This flaw allows an attacker with high privileges to potentially execute arbitrary OS commands. The vulnerability has a medium severity rating with a CVSS 4.0 score of 5.6. A patch is available for this issue. The product is a cloud service, so remediation is typically managed by the vendor.
CVE-2026-27874 is a medium severity vulnerability in Johnson Controls EasyIO FS32 involving the use of hard-coded credentials. This flaw affects versions before 3.0b63 and allows exploitation of default or hard-coded credentials, potentially enabling unauthorized access. The vulnerability has a CVSS 4.0 score of 5.0, indicating a moderate risk. The product is a cloud service, and a patch is available to address this issue.
Uncontrolled recursion in the Ion reader in Amazon Ion Python before 0.15.0 might allow a remote unauthenticated actor to crash the application using the library, resulting in a denial of service, via a crafted, deeply nested Ion value.
To remediate this issue, users should upgrade to version 0.15.0 or later.
The TP-Link Kasa EC70 V4 and EC71 V4 devices have an improper access control vulnerability in their on-chip debug and test interface. The production debug interface is not logically disabled at the firmware or chip level, and the bootloader is not locked. Although the debug traces are physically severed during manufacturing, an attacker with physical access can restore the connection, interrupt the boot process, and manipulate boot parameters to gain an unauthenticated root shell during startup. This allows root-level command access, compromising the device's confidentiality, integrity, and availability. Exploitation requires physical device disassembly and manipulation of hardware and boot processes.
figlet.js versions prior to 1.11.3 contain a vulnerability where the text() and textSync() functions can enter an infinite loop if the whitespaceBreak option is enabled and the specified width is smaller than the width of a single FIGlet character. This occurs because the breakWord() function fails to find a valid break point and does not consume any input, causing generateFigTextLines() to repeatedly process the same input, leading to high CPU usage and memory growth. This issue is resolved in version 1.11.3.
CVE-2026-104183 is a prototype pollution vulnerability in the uhop stream-json library prior to version 3.6.0. The vulnerability arises because the Assembler component assigns object properties using plain assignment, allowing an input key named __proto__ to modify the prototype of parsed objects. This can lead to attacker-controlled inherited properties affecting application logic that relies on prototype values. The global Object.prototype is not affected. The issue is fixed in version 3.6.0.
CVE-2026-103484 is a high-severity vulnerability in pgvector versions before 0.8.7. It involves an out-of-bounds write during the IVFFlat index build process, which can allow a database user with privileges to execute arbitrary code. This vulnerability has a CVSS score of 8.8, indicating a significant risk to confidentiality, integrity, and availability.
CVE-2026-104182 is an inefficient algorithmic complexity vulnerability in the JSONC parser and verifier components of the uhop stream-json library prior to version 3.6.0. The issue arises when processing large valid comments split across many small input chunks, causing quadratic CPU usage and potentially stalling the Node.js event loop. This vulnerability affects only the JSONC parser, not the plain JSON parser. The maintainer notes the attack vector is local, involving user-controlled or locally owned configuration input rather than internet-facing input. The issue is fixed in version 3.6.0.
FilamentPHP versions from 4.0.0 up to but not including 4.13.3 and from 5.0.0 up to but not including 5.8.3 contain a vulnerability where app-based multi-factor authentication (MFA) management actions do not consistently require confirmation of the current password. This allows an attacker with access to an authenticated user session to modify app-based MFA settings or obtain recovery codes without knowing the account password. Email-based MFA is not affected, and the vulnerability does not allow unauthenticated sign-in. The issue is fixed in versions 4.13.3 and 5.8.3.
CVE-2026-55396 is a high-severity vulnerability in Teledyne FLIR Aware2 software affecting PackBot and FirstLook robots. The issue involves cleartext transmission of sensitive operator control traffic over UDP without cryptographic integrity checks. This allows adjacent unauthenticated attackers to intercept, hijack, or modify control communications by sniffing or hijacking network traffic. The vulnerability affects versions up to 6.9.0.2 for PackBot and up to 1.7.9 for FirstLook. No patch or remediation information is provided in the available data.
CVE-2026-55395 is a critical vulnerability in Teledyne FLIR Aware2 software versions up to 6.9.0.2 (PackBot) and 1.7.9 (FirstLook). It involves the use of hardcoded passwords in the access control mechanism, allowing remote unauthenticated attackers to access and reconfigure affected robots by extracting these credentials from firmware or documentation.
Teledyne FLIR Aware2 versions up to 6.9.0.2 transmit sensitive session information over unencrypted 802.11 wireless networks. This allows adjacent unauthenticated attackers to intercept, hijack, or modify session traffic to Teledyne FLIR PackBot robots by sniffing or hijacking network communications. The vulnerability is classified under CWE-319 for cleartext transmission of sensitive information. The CVSS 4.0 base score is 5.3, indicating a medium severity risk.
CVE-2026-55393 is a critical path traversal vulnerability in Teledyne FLIR Aware2 software versions up to 6.9.0.2 (PackBot) and 1.7.9 (FirstLook). It allows remote unauthenticated attackers to read sensitive configuration and security parameters via the web interface by exploiting unvalidated pathnames. This affects both PackBot and FirstLook robots running the vulnerable software versions.
