ILIAS versions before 9.24, 10.12, and 11.5 contain a PHP object injection vulnerability allowing authenticated users with Test creation or import permissions to execute arbitrary code by deserializing crafted Test archives. The vulnerability arises from unsafe unserialize() calls on a malicious tst_sequence attribute, enabling abuse of Guzzle or Monolog gadget chains to write PHP files and execute code remotely. The CVSS 4.0 score is 8.7, indicating high severity.
CVE-2026-110666 is a path traversal vulnerability in cemtan sar2html version 4.0.0. The flaw exists in the updateDb function of the sar2html.py file related to file upload handling. This vulnerability allows remote attackers to manipulate file paths, potentially accessing unauthorized files. The issue was reported early to the project, but no response or fix has been provided yet. The vulnerability has a CVSS 4.0 base score of 6.9, indicating medium severity.
Eclipse Vert.x versions 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0 contain a vulnerability in the HTTP/1.x decoder's header canonicalization process. This flaw causes certain crafted headers, such as 'Content-Xength', to be misinterpreted as standard headers like 'Content-Length'. This vulnerability can be exploited for HTTP request smuggling attacks.
Dell OS Recovery Tool versions prior to 2.4.4 contain an insecure storage of sensitive information vulnerability (CWE-922). This flaw could allow a low privileged attacker with physical access to potentially disclose sensitive information. The vulnerability has a low severity rating with a CVSS score of 2.2. No known exploits are reported in the wild. The issue affects versions from 0 up to but not including 2.4.4.
CVE-2026-53999 is an improper input validation vulnerability in the radius-project radius platform prior to version 0.58.0. The Kubernetes controller deserializes user-controlled annotations on Deployments without verifying ownership, allowing an attacker with annotation modification permissions to trigger privileged deletion of container resources belonging to other tenants in multi-tenant environments. This can cause denial of service by deleting recoverable container resources. The issue is fixed in version 0.58.0.
CVE-2026-110248 is a vulnerability in the Amazon SageMaker Python SDK where sensitive information, specifically plaintext repository credentials, can be inserted into log files. This occurs in the git_utils.py component before versions 3.10.0 for V3 and 2.257.3 for V2. The issue arises because the runclone_command() function does not redact credentials from subprocess error output, potentially exposing them in CloudWatch Logs when a git clone operation fails. Users should upgrade to versions 3.10.0 or later for V3 and 2.257.3 or later for V2 to remediate this issue.
Eclipse Vert.x versions 4.0.0 through 4.5.34, 5.0.0 through 5.0.12, 5.1.0 through 5.1.9, and 5.2.0 contain a scope bypass vulnerability in the ChainAuthHandler component of Eclipse Vert.x Web. This vulnerability occurs when ChainAuthHandler is used with scope-requiring authentication handlers such as JWTAuthHandler or OAuth2AuthHandler. If a user is already authenticated by a preceding handler, ChainAuthHandler skips scope validation, allowing access to resources without proper scope checks.
Dgraph version prior to 25.4.0 has an unauthenticated administrative HTTP interface exposed on port 6080. This interface allows unauthenticated attackers to read cluster state, allocate IDs, and perform destructive membership operations such as removing nodes. Exploitation can disrupt the Zero control plane and destabilize Alpha nodes, resulting in denial of service. The vulnerability arises because administrative endpoints lack authentication or IP whitelisting by default.
CVE-2026-0322 is a remote code execution vulnerability in the management interface of Palo Alto Networks PAN-OS software. It allows an authenticated attacker with network access to execute arbitrary code with root privileges on affected firewalls. The vulnerability affects PAN-OS on PA-Series and VM-Series firewalls and Panorama (virtual and M-Series). Cloud NGFW and Prisma Access are not impacted. The risk is mitigated by restricting management interface access to trusted internal IP addresses as recommended by Palo Alto Networks.
A critical vulnerability exists in the Advanced Malware Protection (AMP) feature of Cisco Secure Email Gateway that allows unauthenticated remote attackers to write arbitrary files and execute commands with root privileges on the underlying operating system. This occurs due to improper handling of email attachments when the file reputation service is enabled. Exploitation requires sending a crafted email attachment to the affected device.
CVE-2026-109506 is an improper authentication vulnerability in TP-Link Systems Inc. RE190 v5 Wi-Fi range extenders. The devices use a custom reversible XOR-and-dictionary transformation in the HTTP web-management login flow. An unauthenticated attacker on the same local network who can capture legitimate administrator login traffic may derive alternative credentials to gain administrator access. Exploitation requires the login to use HTTP and the attacker to observe session key, dictionary, and login values. Successful exploitation allows modification of device configuration settings.
Pipecat's development runner exposes unauthenticated endpoints that can create bot sessions and paid Daily rooms if the runner is deliberately exposed to untrusted networks. The runner is designed only for local development and binds to localhost by default. Exploitation requires misconfiguration to expose it publicly. The impact includes potential resource consumption and exposure of room URLs and join tokens, but does not inherently grant access to external systems or sensitive data. Pipecat 1.6.0 clarifies this boundary and advises against using the development runner in production or exposing it to untrusted traffic.
A path traversal vulnerability exists in dbt-labs dbt-core versions from 2.0.0-alpha.0 up to but not including 2.0.0-alpha.5. The dbt docs serve component exposes an unauthenticated POST /api/v1/query endpoint that allows clients to execute SQL queries via DuckDbViewsBackend without authorization or an allowlist. This enables reading of arbitrary files accessible to the dbt process, including files outside the intended docs index directory. The server binds to localhost by default but can be exposed to a network, increasing risk. The issue is fixed in version 2.0.0-alpha.5.
CVE-2026-63626 is a heap-based buffer overflow vulnerability in the cesanta mongoose embedded web server and network library. The flaw exists in the ppp_handle_ipv6cp() function prior to version 7.23, where it improperly trusts the 16-bit IPv6CP length field without validating it against the actual payload size. This can allow an unauthenticated adjacent peer on a PPP or PPPoE link to send a malformed Configure-Request with an oversized length, leading to out-of-bounds reads and writes in memory buffers. The issue can also cause exposure of adjacent heap memory or hang the event loop. The vulnerability is fixed in version 7.23.
CVE-2026-73261 is a high-severity vulnerability in the cesanta mongoose embedded web server and network library. Versions prior to 7.23 have an improper input validation issue in the built-in TCP/IP stack, where the length of TCP options is not properly checked. This allows an unauthenticated remote peer to corrupt the per-connection Maximum Segment Size (MSS) value, causing subsequent data transmissions to be truncated or zero-length while the TCP connection remains otherwise healthy. The vulnerability is fixed in mongoose version 7.23.
Mongoose versions prior to 7.23 contain an out-of-bounds read vulnerability in the built-in TLS certificate parser. This occurs because the parser fails to verify that a long-form DER element length fits within the remaining certificate buffer, allowing a peer-controlled length to cause invalid memory access during TLS handshake. An unauthenticated malicious TLS server or a client presenting a certificate can trigger this, resulting in denial of service. The issue is fixed in version 7.23.
CVE-2026-73252 is an integer underflow vulnerability in the cesanta mongoose embedded web server's built-in TLS stack prior to version 7.23. The flaw allows a malicious TLS peer to send a specially crafted TLS 1.3 record that triggers a heap out-of-bounds read before certificate or Finished validation, causing a remote denial of service. This occurs because the length calculation underflows, leading to processing of stale buffer contents as trusted data. The issue is fixed in version 7.23.
LDAP Account Manager (LAM) versions prior to 9.6 contain an authentication bypass vulnerability related to WebAuthn two-factor authentication. The challenge state remains in the PHP session after authentication, allowing a user who has already passed password authentication to reuse the signed WebAuthn ceremony state. This flaw requires a valid password, the same PHP session, and a valid authenticator signature, limiting practical risk. The issue is resolved in version 9.6.
CVE-2026-85714 is a critical code injection vulnerability in Stirling-Tools Stirling-PDF versions prior to 2.13.2. An authenticated administrator using the default H2 database and security mode can upload a crafted SQL file that bypasses input validation, enabling execution of dangerous H2 functions. This leads to arbitrary file access and ultimately allows operating-system command execution as the JVM service account. The issue is fixed in version 2.13.2.
cpp-httplib versions from 0.29.0 up to but not including 0.51.0 contain an HTTP request/response splitting vulnerability due to improper neutralization of CRLF sequences in HTTP headers. The issue arises because Client::open_stream accepts a path that bypasses encoding protections, allowing injection of crafted request metadata. Exploitation requires the application to pass remote user input into this vulnerable path and a backend or intermediary that processes the injected data. The vulnerability impacts integrity by enabling modification of backend-visible request data but does not directly affect confidentiality or availability. This vulnerability is fixed in version 0.51.0.