Threat database

CVE-2026-100730 is a critical deserialization vulnerability in Grid Protection Alliance's openPDC and openHistorian products. It involves a service console interface that deserializes client-supplied data. On systems without Windows Authentication, this interface is accessible to unauthenticated network attackers; with Windows Authentication, attackers must be authenticated. Exploitation could allow remote code execution with the privileges of the affected service account.

Before 4.92.0, Docker Desktop for Windows did not verify the signature of a package supplied to Docker Desktop Installer.exe install -package. An attacker able to provide a crafted package and convince a user to approve the Docker-signed UAC prompt could execute attacker-controlled installer actions as LocalSystem.

The npm package @galicia-toolkit-nestjs/commons contains a malicious native binary that collects sensitive environment variables related to cloud and CI credentials, along with system information, and exfiltrates this data to a hardcoded external server. The package mimics an internal organizational scope to trick users into installing it, and it persists by daemonizing a background process. Multiple published versions are affected, and no source code or build tooling is provided for the native component, making its behavior opaque.

A flaw was found in libhangul. When parsing Hanja dictionary files, the library fails to verify that an entry contains a valid value alongside its key. By providing a specially crafted dictionary file to an application that queries it, an attacker can trigger an unexpected application crash, resulting in a Denial of Service (DoS).

Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in TMT Machinery Industry and Trade Co. Ltd. Talassoft Industrial Management Software allows Stored XSS. This issue affects Talassoft Industrial Management Software: before V16.0.1.

Crux Agent from 1.9.0 before 2.0.3 uses the full SKA bilocation key as the WireGuard preshared key. When a peering session negotiates use of SHA-512, the key produced is 64 bytes instead of the 32 bytes WireGuard requires. The agent does not validate this size; instead it attempts to use the `wg set` command to update the live tunnel, and write the invalid key to the WireGuard configuration file. The update fails, so the live tunnel keeps using its previous preshared key until the tunnel is shut down. The tunnel will fail to start when restarted. For a peer which has never successfully negotiated a 32-byte bilocation key in a Crux C2 organization which has the "Enforce SKA Use" setting turned off, no preshared key will be set for the tunnel. Therefore, an attacker who is able to intercept and store the peer's traffic, and has access (or will have access) to a cryptographically relevant quantum computer, will be able to decrypt the tunnel.

CVE-2026-62026 is a Cross-Site Request Forgery (CSRF) vulnerability affecting MIGHTYminnow's Dashboard Notes product versions up to and including 1.0.3. The vulnerability allows an attacker to perform unauthorized actions on behalf of an authenticated user. It has a high severity with a CVSS score of 7.1, indicating significant impact on confidentiality, integrity, and availability. No patch or remediation information is provided in the available data.

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Fuelthemes Werkstatt werkstatt allows PHP Local File Inclusion.This issue affects Werkstatt: from n/a through 4.8.3.

CVE-2026-94061 is a reflected cross-site scripting (XSS) vulnerability in Designthemes Whistle - Sports Club software versions up to and including 4.2. The flaw involves improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. This vulnerability has a high severity rating with a CVSS score of 7.1.

CVE-2026-94060 is a reflected cross-site scripting (XSS) vulnerability in Bracketweb Voldor versions up to and including 1.0.0. It arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The vulnerability has a high severity with a CVSS score of 7.1. No patch or remediation information is provided in the available data.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bracketweb Ogency ogency allows Reflected XSS.This issue affects Ogency: from n/a through 1.0.0.

CVE-2026-94058 is a reflected cross-site scripting (XSS) vulnerability in Bracketweb Treck versions up to and including 1.0.0. This flaw arises from improper neutralization of input during web page generation, allowing an attacker to inject malicious scripts. The vulnerability has a high severity rating with a CVSS score of 7.1. No patch or remediation information is provided in the available data.

Apache Camel Karavan versions from 4.0.0 up to but not including 4.22.1 contain an improper input validation vulnerability. This flaw allows an authenticated user of any role to deploy arbitrary Kubernetes resources by submitting crafted kubernetes.yaml files without restrictions on resource kinds or security-sensitive pod options. The vulnerability enables the creation of pods with elevated privileges or access to sensitive host resources. The issue is fixed in version 4.22.1.

CVE-2026-103412 is a path traversal vulnerability in Apache Camel Karavan versions from 3.18.0 up to but not including 4.22.1. An authenticated user can supply a project file name containing '../' sequences, causing files to be written outside the intended project directory. This allows overwriting of application configuration or classpath files, potentially enabling code execution within the Karavan container. The issue is fixed in version 4.22.1.

CVE-2026-86405 is a critical vulnerability in the Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module. It involves improper verification of cryptographic signatures, allowing signature spoofing due to improper validation. This affects versions from 26.8.1 up to but not including 26.9.1. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.

The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing raster image data in Affinity document files, leading to an out-of-bounds read and the dereference of an untrusted pointer. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could result in memory corruption or an application crash.

The Affinity by Canva application before 3.3.1 (October 2026 release) did not perform adequate bounds checking when parsing arrays of strings in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.

The Affinity by Canva application before 3.3.1 (October 2026 release) did not correctly handle incomplete UTF-8 character sequences when parsing text in Affinity document files, leading to a heap buffer over-read. A threat actor could craft an Affinity document that, when opened by a user in Affinity, could disclose the contents of adjacent heap memory in the document's text or result in an application crash.

The Affinity by Canva application for macOS before 3.3.1 (October 2026 release) did not safely calculate the size of an image buffer when generating QuickLook thumbnails and previews of Affinity document files, leading to an integer overflow and a heap-based buffer overflow. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could corrupt heap memory and cause the thumbnail or preview extension to crash.

The Affinity by Canva app for macOS before 3.3.1 (October 2026 release) did not perform adequate bounds checking when generating QuickLook thumbnails and previews of Affinity document files, leading to an out-of-bounds heap read. A threat actor could craft an Affinity document that, when displayed or previewed by a user in Finder, could disclose the contents of adjacent heap memory, including memory addresses, in the rendered thumbnail or preview image.