CVE-2026-93322 is a medium severity vulnerability in moby BuildKit where improper validation of an array index can cause the buildkitd daemon to panic and terminate. This results in interruption of all builds running on the affected daemon. The vulnerability affects versions from 0 up to and including 0.33.0. There is no information about available patches or exploits in the wild.
Plane, an open-source project management tool, has an authorization bypass vulnerability prior to version 1.4.0. The BulkEstimatePointEndpoint.destroy function allows an administrator or workspace member to delete estimate points from other workspaces by supplying the target UUID without proper scoping. This cross-tenant insecure direct object reference (IDOR) vulnerability is fixed in version 1.4.0.
Plane, an open-source project management tool, had a Server-Side Request Forgery (SSRF) vulnerability in versions prior to 1.4.0. The issue occurred in the OAuth avatar synchronization flow, where the application fetched avatar URLs from provider user data without validating internal IP addresses and followed redirects by default. This allowed attackers to supply avatar URLs that redirected to internal-only resources, such as metadata endpoints. The fetched content was then uploaded as a user avatar and exposed via a public API endpoint, enabling exfiltration of internal data. The vulnerability is fixed in version 1.4.0.
Plane, an open-source project management tool, has a high-severity cross-site scripting (XSS) vulnerability (CVE-2026-104979) affecting versions prior to 1.4.0. The vulnerability allows any authenticated user to inject arbitrary HTML into projects with a published DeployBoard and intake enabled. When a project member or viewer clicks the malicious link, JavaScript executes in their session, potentially exfiltrating a long-lived API token. This issue is fixed in Plane version 1.4.0.
Plane, an open-source project management tool, had an authorization flaw prior to version 1.4.0. Authenticated users could access the project invitation list endpoint if they knew the workspace slug and project ID. Additionally, the public project invitation join endpoint accepted invitations based solely on a submitted email address without mailbox verification. This allowed attackers to enumerate invitations, register accounts with invited email addresses, and join targeted workspaces and projects. The vulnerability is fixed in Plane version 1.4.0.
CVE-2026-78413 is a medium severity vulnerability in Rapid7 Velociraptor versions before 0.77.3. It involves incorrect default permissions in the Windows.Sysinternals.SysmonLogForward artifact, which allows users with COLLECT_CLIENT permissions (typically the Investigator role) to specify an arbitrary binary path and execute a different binary than intended. This could lead to limited confidentiality, integrity, and availability impacts. Exploitation requires existing artifact collection permissions on the endpoint.
Plane is an open-source project management tool. Prior to 1.4.0, the fix for CVE-2026-27706 and GHSA-jcc6-f9v6-f7jw, an SSRF in work-item link unfurling shipped in v1.2.2, remains incomplete in the v1.3.1 GA release. Any authenticated project member can make the server fetch attacker-selected internal targets, including cloud metadata at 169.254.169.254, and read the response body returned as the link title or favicon. Complete hardening exists on main in PR 9163 but was not included in an earlier released tag. This issue is fixed in 1.4.0.
Plane, an open-source project management tool, has a Server-Side Request Forgery (SSRF) vulnerability identified as CVE-2026-104976. Versions prior to 1.4.0 do not properly validate the GITEA_HOST URL, allowing requests to internal or private IP addresses during the Gitea OAuth flow. Additionally, avatar URLs from Gitea user profiles are not validated, enabling an attacker to cause Plane to fetch internal resources. This vulnerability is fixed in version 1.4.0.
CVE-2026-105385 is a medium severity SQL injection vulnerability in the onetwothreeneth HospitalManagementSystem affecting an unknown functionality in transaction_details.php. The vulnerability allows remote attackers to manipulate the transaction_id parameter to perform SQL injection. The product uses a rolling release system, so specific affected or fixed versions are not disclosed. The issue was reported early but has not yet received a vendor response or patch. Public exploit code has been disclosed.
Plane is an open-source project management tool. Prior to 1.4.0, Plane's dashboard asset endpoints in plane/app/views/asset/v2.py were remediated for two cross-tenant asset IDORs, CVE-2026-27705 and CVE-2026-46558. Those fixes added a membership check and project_id and workspace__slug scoping to the asset endpoints in that file. The Spaces app in plane/space/views/asset.py serves related public-board operations under /api/public/ but was not remediated. Its EntityAssetEndpoint and AssetRestoreEndpoint resolve a DeployBoard from a public anchor and then read or modify FileAsset rows scoped only to the board's workspace, without a membership check or project_id constraint. An attacker can therefore read, overwrite, or restore assets across projects and workspaces. This issue is fixed in 1.4.0.
Plane, an open-source project management tool, has an improper access control vulnerability prior to version 1.4.0. In affected versions, a user account deactivated by setting is_active=False can still log in using existing credentials. Upon successful login, the account is silently reactivated by setting is_active back to True without notifying administrators. This vulnerability is fixed in version 1.4.0.
Plane, an open-source project management tool, has a Server-Side Request Forgery (SSRF) vulnerability identified as CVE-2026-104973. The issue exists in versions prior to 1.4.0 where webhook IP address validation is incomplete, allowing DNS rebinding to bypass SSRF protections. This vulnerability is fixed in version 1.4.0.
FacturaScripts before version 2026.7 contains a PHP object injection vulnerability in WidgetSelect::processFormData() that allows authenticated attackers to trigger unserialize() on raw POST data without an allowed_classes filter for multiple-select fields. Attackers can submit a serialized XLSXWriter object as the field value to invoke its __destruct() method, deleting arbitrary attacker-specified files such as config.php or backup data, resulting in denial of service and potential application reinstall hijack.
CVE-2026-101919 is a high-severity vulnerability in Red Hat Multicluster Engine for Kubernetes involving improper input validation in the HyperShift operator. The operator copies user-supplied kubeconfig secrets into a privileged namespace without proper sanitization. An authenticated user with permissions to create clusters and secrets can exploit this by providing a configuration with unauthorized executable plugins, potentially leading to arbitrary code execution in the control plane.
An information disclosure vulnerability in SiYuan kernel allows any authenticated user to retrieve TLS private keys via the /api/file/getFile endpoint due to an incomplete blocklist in the IsForbiddenAbsPath() function. The TLS private key (conf/key.pem) and CA private key (conf/ca.key) are not blocked and can be accessed, potentially compromising encrypted communications and certificate trust. This affects all installations including those where TLS is inactive, as the key files are generated on every boot.
A vulnerability in the SiYuan kernel allows unauthorized access to historical snapshots of sensitive files such as data/.siyuan/publishAccess.json and data/templates/* via the /history/*path and /repo/diff/*path HTTP routes. These routes do not enforce the same access restrictions as live-file endpoints, potentially exposing plaintext publish-mode passwords and template files from prior versions. The issue arises because the new centralized guard util.IsForbiddenAbsPath() is not called in these handlers, leading to missing authorization checks on historical data.
The npm package 'serpacksven1' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
The npm package 'serpacksven2' contains malicious code that can fully compromise any computer on which it is installed or running. This compromise potentially grants an attacker full control over the affected system. Immediate removal of the package is recommended, but due to the severity of the compromise, simply removing the package may not eliminate all malicious components. All secrets and keys stored on the compromised system should be rotated from a separate, secure device.
The npm package 'documenclient' contains malicious code that compromises any computer on which it is installed or running. Installation of this package can lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package is advised, but full remediation may require rotating all secrets and keys from a different, uncompromised system due to potential persistent control by an attacker.