Lychee versions prior to 7.6.1 have an authentication bypass vulnerability due to lack of throttling or lockout on album unlock attempts. This allows unauthenticated attackers to perform unlimited password guesses on password-protected albums, potentially gaining unauthorized access to private photos. The issue is fixed in version 7.6.1.
Lychee is a free, open-source photo-management tool. Prior to 7.6.0, the POST /api/v2/Photo::fromUrl flow validates a hostname and its resolved addresses in app/Rules/PhotoUrlRule.php but later passes the original hostname through app/Actions/Import/FromUrl.php to app/Image/Files/DownloadedFile.php for a separate fopen connection. An authenticated attacker who controls DNS responses can cause validation to observe a public address and the subsequent fetch to resolve the same hostname to a private or otherwise forbidden address. This DNS rebinding time-of-check to time-of-use mismatch bypasses the intended server-side request forgery protections and can reach services available from the Lychee server, subject to deployment and TLS behavior. This issue is fixed in version 7.6.0.
CVE-2026-57568 is a cross-site scripting (XSS) vulnerability in Lychee, an open-source photo-management tool. Versions prior to 7.6.0 allow authenticated users with album-edit permissions to inject JavaScript URIs in album or photo Markdown descriptions due to unsafe link allowance. This malicious script is rendered and executed when a visitor, including unauthenticated users, clicks the link in a public album. The vulnerability can lead to session data exposure or unauthorized authenticated requests in the victim's browser context. This issue is fixed in Lychee version 7.6.0.
CVE-2026-85634 is a path traversal vulnerability in the ContentRepositoryImpl.copyExplodedContent function of the wildfly-core library used by WildFly and JBoss EAP, affecting Red Hat Fuse 7. An attacker with the Deployer RBAC role can exploit this flaw by supplying an unsanitized deployment name containing path traversal sequences to access files outside the intended deployment directory. This can lead to deletion or creation of arbitrary files and directories, resulting in full privilege escalation to the management SuperUser role. The vulnerability has a high severity with a CVSS score of 8.8.
CVE-2026-100353 is a high-severity vulnerability in kin-openapi versions >=0.136.0 and <0.149.0 that causes a nil pointer dereference (NULL pointer dereference) during request validation. The issue arises when an OpenAPI 3.1 array schema omits the 'items' keyword, which is allowed by JSON Schema 2020-12. This leads to unguarded dereferences in multiple code paths handling query parameters, deepObject query parameters, and URL-encoded request bodies, causing deterministic panics triggered by unauthenticated clients.
CVE-2026-100354 is a high-severity vulnerability in kin-openapi versions prior to 0.149.0 involving uncontrolled recursion in runtime schema validation. While the spec loader and spec-time validator safely handle circular schema references, the runtime validators lack cycle detection, causing unbounded recursion when validating request or response data against schemas with circular allOf/anyOf/oneOf references. This leads to a fatal stack overflow in Go, crashing the entire server process and terminating all goroutines, including those serving unrelated clients. The vulnerability affects both response validation and request parameter decoding paths. No recoverable panic occurs, making the failure unrecoverable and causing a complete process termination.
kin-openapi versions prior to 0.148.0 improperly handle unusual numeric values such as YAML NaN and infinity during OpenAPI 3.1 validation. This flaw allows a remote unauthenticated client to send specially crafted YAML request bodies containing .nan, .inf, or -.inf values, triggering a panic in the dependency jsonschema v6.0.2. The panic occurs due to dereferencing a nil big.Rat during request validation, which can cause process termination in some hosting environments. The issue is fixed in version 0.148.0.
CVE-2026-100351 is an authentication bypass vulnerability in the kin-openapi library's openapi3filter.ValidationHandler.Middleware. It arises when a downstream gorilla/mux router uses UseEncodedPath(), causing a mismatch between the decoded path used for validation and the encoded path used for routing. This allows an unauthenticated request with an encoded path to bypass authentication and reach a protected handler. The issue affects kin-openapi versions from 0.144.0 up to but not including 0.147.0. The vulnerability can lead to unauthorized execution of protected handlers without invoking the authentication callback.
CVE-2026-100349 is a NULL pointer dereference vulnerability in the kin-openapi library (github.com/getkin/kin-openapi) affecting versions up to 0.145.0. The issue occurs when a response header in an OpenAPI spec declares a 'content' field instead of a 'schema', causing the ValidateResponse function to panic due to a nil pointer dereference. This crash happens even though the document passes validation, leading to a process crash on every call to the affected operation. The vulnerability can cause denial of service if the spec is attacker-controlled or comes from an untrusted source.
CVE-2026-100350 is a medium severity vulnerability in the getkin kin-openapi library affecting versions >=0.145.0 and <0.146.0. It involves uncontrolled resource consumption due to repeated compilation of an invariant regular expression inside a loop over all query keys when decoding deepObject-style query parameters. This causes CPU usage to scale linearly with the number of query keys, enabling denial of service by sending requests with many junk query keys.
CVE-2026-92982 is a high-severity vulnerability in Red Hat Ansible Automation Platform 2.6 involving improper neutralization of special elements in a Jinja2 template engine. A low-privileged Kubernetes user can exploit this flaw by crafting malicious custom resource specifications that are processed without proper sanitization, enabling execution of arbitrary code within the operator pod. This can lead to privilege escalation and full control over the operator's service account with cluster-wide permissions. Red Hat has issued an official security advisory and update addressing this issue.
CVE-2026-100347 is a medium-severity vulnerability in the getkin kin-openapi library's openapi3filter.ValidationHandler middleware. It occurs because the legacy router matches HTTP methods verbatim against a trie of upper-cased standard methods, causing requests with non-standard or non-canonical HTTP methods (e.g., PROPFIND or lowercase get) to miss the route and trigger a panic. This panic happens before authentication, leading to an unauthenticated, remotely triggerable denial of service via connection aborts and unbounded error log growth. The vulnerability affects versions prior to 0.145.0 and has no known fixes or patches as of the published date.
CVE-2026-97712 is a high-severity vulnerability in Sonatype Nexus Repository 3 that allows users with create or update role permissions to grant themselves roles and privileges they do not originally possess. This flaw can escalate their access up to full administrative rights, potentially compromising the repository's security.
CVE-2026-97667 is a medium severity cross-site scripting (XSS) vulnerability in Sonatype Nexus Repository 3. It allows a user with edit permission on a hosted R repository to inject script content into the metadata of an uploaded R package. This script executes in the browser of any user who views the package details, running with the permissions of the viewing user. Both authenticated and anonymous users (if granted permission) can exploit this. The vulnerability affects versions from 3.28.0 up to but not including 3.97.0.
Sonatype Nexus Repository 3 contains a vulnerability where an unauthenticated remote attacker can supply attacker-controlled input to a Java class loading call via an ExtDirect endpoint. This allows the attacker to determine the presence of specific classes in the application but does not enable code execution by itself. The issue affects versions from 3.0.0 up to but not including 3.97.0. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6.9.
CVE-2026-97665 is a high-severity vulnerability in Sonatype Nexus Repository 3 affecting the NuGet Components API upload path. It involves a missing authorization check that allows users with only read and browse privileges to upload and persist NuGet symbol packages (.snupkg) to a hosted repository, bypassing normal write-permission restrictions. This requires a hosted NuGet repository with Symbol Server enabled. If anonymous access is enabled, the anonymous user can exploit this without authentication due to default read and browse privileges.
This content is an announcement of a live Ask Me Anything (AMA) session hosted by the Firefox security team on Reddit. The team invites the community to ask questions about securing the open-source Firefox browser, covering topics such as anti-fingerprinting, security hardening, product security, fuzzing, web security standards, and privacy protections.
CVE-2026-100348 is a medium severity vulnerability in the kin-openapi library's openapi3 loader component. It involves a NULL pointer dereference in the resolveComponent function when processing additionalProperties in schema references. This occurs because the code dereferences c.Value.AdditionalProperties without checking if c.Value is nil, leading to a panic during loading of crafted OpenAPI documents. The issue affects kin-openapi versions prior to 0.145.0 and can cause denial of service by crashing applications that load untrusted OpenAPI specifications.
CVE-2026-110958 is a critical heap-based buffer overflow vulnerability in the Wavlink WN530HG4B device, specifically in an unknown function within the api.cgi file. The vulnerability allows remote attackers to exploit the flaw without authentication. The vendor has released a firmware update (version 2026-09-24-841a51c6d5_tclinux.bin) that addresses the issue by changing the command invocation method and adding input validation.
CVE-2026-111096 is a stored cross-site scripting (XSS) vulnerability in JetBrains TeamCity affecting versions before 2026.2, 2026.1.4, and 2025.11.8. This vulnerability allows an attacker with limited privileges and user interaction to inject malicious scripts into the classic build log. The vulnerability has a medium severity with a CVSS score of 6.7.