A heap buffer overflow vulnerability (CVE-2026-39919) exists in Ghostscript's JPEG 2000 output adapter. This issue affects various Red Hat Enterprise Linux 8 distributions and related packages. The vulnerability is rated as medium severity. Red Hat has released a security update to address this flaw in Ghostscript version 9.27-18.el8_10. The update mitigates the risk by fixing the heap buffer overflow. No known exploits are reported in the wild at this time.
An integer overflow vulnerability in the compositing component of Google Chrome versions prior to 154.0.8037.97 allows a remote attacker to leak cross-origin data by crafting a malicious HTML page. The vulnerability has a CVSS score of 4.3, indicating medium severity. No known exploits are reported in the wild. No explicit patch information is provided in the input data.
A high-severity vulnerability (CVE-2026-88779) affects Citrix NetScaler ADC and NetScaler Gateway products, including their FIPS variants. Multiple versions prior to 14.1-73.41, 13.1-64.28, and 13.1-37.282 are impacted. The vulnerability is publicly known but no confirmed exploits have been observed in the wild. No patch or remediation information is currently available.
A security vulnerability has been detected in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. Affected by this vulnerability is an unknown functionality of the file admin/admin.php of the component Role Attribute Handler. Such manipulation of the argument Name leads to authorization bypass. The attack can be launched remotely. The exploit has been disclosed publicly and may be used. This product does not use versioning. This is why information about affected and unaffected releases are unavailable. Multiple endpoints are affected. The project was informed of the problem early through an issue report but has not responded yet.
CVE-2026-105170 is a medium severity vulnerability in the kishor-23 food-waste-management-system. It involves missing authentication in the admin/signup.php component, allowing remote attackers to manipulate the sign argument without authentication. The vulnerability is publicly known and exploitable. No specific affected versions or patches are available due to the product's continuous delivery model and lack of vendor response.
CVE-2026-105221 is a critical vulnerability in the gist RubyGem before version 6.1.0. It involves improper certificate validation due to the http_connection in lib/gist.rb setting VERIFY_NONE. This flaw allows on-path attackers to intercept and modify HTTPS traffic to the GitHub API, potentially stealing OAuth tokens and login credentials to access and alter the victim's gists.
A security flaw has been discovered in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This impacts an unknown function of the file delivery/delivery.php of the component Take Order Handler. The manipulation of the argument order_id/delivery_person_id results in sql injection. It is possible to launch the attack remotely. The exploit has been released to the public and may be used for attacks. This product takes the approach of rolling releases to provide continious delivery. Therefore, version details for affected and updated releases are not available. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability was identified in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. This affects an unknown function of the file admin/admin.php of the component Order Assignment Block. The manipulation of the argument order_id/delivery_person_id leads to sql injection. It is possible to initiate the attack remotely. The exploit is publicly available and might be used. This product is using a rolling release to provide continious delivery. Therefore, no version details for affected nor updated releases are available. The project was informed of the problem early through an issue report but has not responded yet.
A vulnerability was determined in kishor-23 food-waste-management-system 411989e3ecb82895e53dca7865f72145f03d7d93/b3a70b2c492dc9904de5be1ad9389bd79b87f82c. The impacted element is an unknown function of the file admin/donate.php. Executing a manipulation of the argument location can lead to sql injection. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. This product utilizes a rolling release system for continuous delivery, and as such, version information for affected or updated releases is not disclosed. The project was informed of the problem early through an issue report but has not responded yet.
The alexpechkarev/google-maps Laravel package through 12.16 disables TLS certificate verification by default because the bundled config sets ssl_verify_peer to FALSE, which is passed to CURLOPT_SSL_VERIFYPEER. On-path attackers can present any certificate to intercept Google Maps web-service requests, steal the API key from the query string, and tamper with responses.
Twine 2 desktop through 2.12.0 contains a cross-site scripting vulnerability in importStories() that executes markup from imported story files in the editor window. Attackers can craft a story file whose script calls the twineElectron openWithScratchFile IPC bridge to write and open a .bat file, executing code as the user.
CVE-2026-105166 is a SQL injection vulnerability in the kishor-23 food-waste-management-system affecting the insert function in fooddonateform.php. The vulnerability arises from manipulation of the image-choice argument, allowing remote attackers to execute SQL injection. The product uses a rolling release model, so specific affected versions are not defined. The issue was reported early but remains unpatched. The vulnerability has a medium severity score of 6.9 and a public exploit is available.
A vulnerability has been found in devopspolis secrets-replicator up to 0.4.0. Impacted is the function process_single_secret of the file src/handler.py of the component AssumeRole Handler. Such manipulation of the argument external_id leads to incorrect permission assignment. The attack can be executed remotely. Upgrading to version 0.5.0 is recommended to address this issue. The name of the patch is b42239405fbf4fae3c3f0048fc0b4225112edceb. It is suggested to upgrade the affected component.
CVE-2026-105164 is an out-of-bounds read vulnerability in NASA cFS versions 7.0.0 and 7.0.1. The flaw exists in the function CFE_FS_ParseInputFileNameEx within the file cfe/modules/fs/fsw/src/cfe_fs_api.c. This vulnerability can be remotely exploited and may lead to unauthorized memory access. A fix has been developed but is pending acceptance in a pull request. The issue has a medium severity rating with a CVSS score of 5.1.
A vulnerability was detected in crossplane crossplane-runtime up to 2.2.2/2.3.2. This vulnerability affects the function Get of the file pkg/xpkg/client.go of the component ImageConfig. The manipulation results in time-of-check time-of-use. The attack may be launched remotely. Upgrading to version 2.2.3, 2.3.3 and 2.4.0-rc.1 is able to resolve this issue. The patch is identified as bee99c6cd6ca81878acca2940a2f0a02169fc208. You should upgrade the affected component.
The anthropic-sdk package version 0.1.0 on PyPI contains malicious code that downloads and executes a remote script. It fingerprints the environment to detect sandboxing and delays execution before exfiltrating sensitive data such as credentials, environment variables, AI chat files, and SSH keys. If HTTPS exfiltration fails, it attempts DNS-based data exfiltration. The package also uses DNS to control execution centrally.
YesWiki versions before 4.6.7 have a cross-site scripting (XSS) vulnerability in the Bazar valeur action. This flaw allows page editors to inject malicious scripts by rendering unescaped HTML fetched from a remote URL. Exploitation involves attackers directing the vulnerable script to a controlled server returning crafted markup that executes JavaScript in viewers' browsers. The vulnerability has a medium severity rating with a CVSS score of 5.4.
Mammoth.js versions from 1.3.0 up to but not including 1.12.3 contain a regular expression denial of service (ReDoS) vulnerability in the style map tokeniser. This vulnerability arises from overlapping regex alternatives in the tokeniser code, allowing an attacker to supply a crafted .docx file with an unterminated quoted string of repeated backslash escapes. This can block the Node.js event loop, causing a denial of service condition. The vulnerability has a high severity score of 8.7 CVSS 4.0 and does not require user interaction or privileges to exploit.
A critical vulnerability (CVE-2026-105218) exists in gopay versions before 1.5.119 where TLS certificate verification is disabled in the defaultClient() function. This flaw allows man-in-the-middle attackers to impersonate payment provider APIs by presenting any certificate, enabling them to read sensitive merchant credentials, signatures, and transaction data, as well as modify payment, refund, and order query responses.
Cockpit CMS versions 2.12.0 up to but not including 2.14.1 disable TLS certificate verification in the cron.php web worker restart request. This improper certificate validation allows network attackers performing man-in-the-middle attacks on the outbound connection to the site URL to present any certificate and capture the worker token. The vulnerability has a low severity rating with a CVSS score of 2.3.