A path traversal vulnerability exists in Bower decompress-zip through version 0.3.3. The vulnerability occurs due to improper validation of archive entry paths during ZIP extraction, allowing crafted ZIP files to write files outside the intended directory. This can lead to arbitrary file overwrite, application compromise, or remote code execution depending on the environment and writable paths.
Zimbra Collaboration Suite versions 10.1.0 through 10.1.19 contain an authorization bypass vulnerability in the EWS FindItem handler. This flaw allows an authenticated user with EWS enabled to access complete mailbox items, including raw MIME content and attachments, from other local accounts without proper share or delegation permissions.
A kernel buffer overflow vulnerability exists in HP Sure Click versions prior to 4.4.33. This flaw may allow a local attacker with high privileges to escalate their privileges further or execute arbitrary code. HP has released version 4.4.33 to fix this issue.
A deserialization of untrusted data vulnerability (CVE-2026-105436) exists in MainWP Child plugin versions up to 6.2.1. This flaw allows object injection, which can lead to high impact on confidentiality, integrity, and availability. The vulnerability has a high severity score of 8.8 (CVSS 3.1).
A vulnerability in the ConfirmNameConstraints() function of wolfSSL versions 5.9.1 and 5.9.2 can cause a Denial of Service (DoS). This occurs when attackers provide specially crafted Certificate Authority certificates, causing wolfSSL-based TLS clients to incorrectly reject valid certificates that lack Subject Alternative Names (SAN).
MariaDB Connector/Node.js versions prior to 3.2.5, 3.3.4, 3.4.7, and 3.5.4 contain a vulnerability where malformed GeoJSON Polygon and MultiPolygon data can cause uninitialized Node.js heap memory to be disclosed in database values. This occurs because the connector allocates buffer space based on an unchecked numeric length before verifying the ring is an array, leading to potential exposure of sensitive information such as other users' data, session material, database credentials, or TLS key material. The issue is fixed in the specified versions.
A vulnerability in mariadb-connector-nodejs versions 3.3.0 up to but not including 3.5.4 causes an uncaught exception during zero-configuration TLS authentication using the client_ed25519 plugin. This results in a denial of service where the Node.js client process crashes and exits. The issue arises because the Ed25519PasswordAuth.hash() method references an undefined variable, causing a ReferenceError. No credentials or data are exposed, but availability is impacted. The flaw can be triggered by an attacker capable of intercepting the connection and presenting a self-signed certificate. The vulnerability is fixed in version 3.5.4. Workarounds include providing the server certificate to the client or using other authentication plugins.
GnuTLS version 3.8.13 contains a vulnerability due to improper certificate validation that causes the application to accept certificates with invalid extensions. This flaw affects multiple specific versions of the gnutls26 package. The vulnerability has a high CVSS score of 9.1, indicating a critical impact on confidentiality and integrity. No vendor advisory or patch information is provided, so patch status is not confirmed.
GnuTLS version 3.8.13 contains a vulnerability where improper certificate validation causes the application to reject legitimate certificates. This results in a Denial of Service (DoS) condition affecting valid users. The issue does not impact confidentiality or integrity but causes availability disruption.
In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the maintenance service directly without any policy enforcement. Any holder of a valid Mistral token, regardless of assigned role, can read and change the service's cluster-wide maintenance state. Setting the state to PAUSED stops processing of new workflow and execution objects across all tenant projects until an operator restores it.
CVE-2026-93858 is a high-severity OS command injection vulnerability in OpenStack Mistral up to version 23.0.0. The vulnerability arises because the std.ssh_proxied action passes a user-supplied proxy_command directly to paramiko.ProxyCommand() without sanitization. An authenticated project member can exploit this to execute arbitrary local commands on the executor host under the executor's service account. This affects Mistral deployments that allow the std.ssh_proxied action, which is enabled by default.
A path traversal vulnerability exists in python-datamodel-code-generator versions >=0.59.0 and <0.81.0, allowing attacker-controlled Protobuf schemas to write files outside the intended temporary directory. The vulnerability is due to improper handling of import paths in weak-import stubs, enabling file creation or overwriting in writable locations. The written content is limited to a fixed Protobuf syntax declaration, and no direct arbitrary code execution has been demonstrated. The issue occurs before the Protobuf compiler runs and can be triggered by processing malicious schemas via local files or URLs. A fix has been merged but no patched package release is currently available.
FFmpeg versions prior to 8.1.3 contain a vulnerability in the HLS demuxer that allows attackers to bypass protocol and allowed_extensions restrictions. This occurs when a crafted master playlist includes child playlists using disallowed protocols or non-multimedia local files, causing the parse_playlist() function to open resources that should be blocked by the HLS security policy. The vulnerability has a medium severity with a CVSS score of 4.3.
FFmpeg versions before 7.1.4 and 8.0.x before 8.0.2 contain a server-side request forgery (SSRF) vulnerability in the ff_rtsp_connect() function within libavformat/rtsp.c. This vulnerability allows malicious RTSP servers to redirect FFmpeg to internal hosts and ports using other schemes, bypassing the -protocol_whitelist option. The issue is tracked as CVE-2026-107698 and has a medium severity rating with a CVSS score of 5.4.
FFmpeg versions up to 9.0.2 contain an infinite loop vulnerability in the ff_rtsp_connect() function of libavformat/rtsp.c. This occurs because the function follows RTSP 3xx redirect responses without limiting the number of redirects. An attacker controlling an RTSP server can exploit this by sending repeated 302 redirects, causing the client to enter an endless reconnect loop that saturates a CPU core. The vulnerability has a CVSS score of 6.5, indicating medium severity.
FFmpeg versions prior to 8.1.3 contain an infinite loop vulnerability in the HLS demuxer. This flaw allows remote attackers to cause a denial of service by exploiting the parse_playlist() function, which improperly accepts Master Playlist tags inside Media Playlists. Crafted self-referencing playlists can cause unbounded CPU and I/O consumption, leading to service disruption.
CVE-2026-107378 is a high-severity vulnerability in Kozea CairoSVG versions prior to 2.9.1 caused by inefficient algorithmic complexity in SVG path rendering. The vulnerability arises from two independent O(n²) operations in the path parser and marker handling code, leading to excessive CPU usage when rendering SVGs with many path segments. An attacker can exploit this by submitting a crafted SVG with a large number of path segments, causing denial of service due to high CPU consumption during rendering.
QloApps through 1.7.0 contains an authorization bypass vulnerability in AdminHotelRoomsBookingController::postProcess() that allows restricted back-office employees to access other hotels' data by supplying an id_hotel parameter. Attackers can modify the id_hotel URL parameter on the Book Now page to view room availability and booking status of hotels outside their assigned profile access.
A cross-site scripting (XSS) vulnerability exists in darylldoyle svg-sanitizer versions prior to 1.0.0. The issue arises because the sanitizer validates SVG href attributes after XML DTD entity expansion but serializes the original entity reference without the DTD declaration. This discrepancy allows crafted entities to bypass validation and later be interpreted as JavaScript URLs during HTML5 rendering, enabling script execution in the embedding page's origin. The vulnerability is fixed in version 1.0.0.
A resource allocation vulnerability exists in darylldoyle svg-sanitizer versions prior to 1.0.0. The issue arises from a crafted SVG DTD with a #FIXED attribute default that causes a double removal of the same attribute, corrupting libxml state and terminating the PHP worker. This can be exploited by submitting malicious SVG content to degrade or exhaust application availability. The vulnerability is fixed in version 1.0.0.