CVE-2026-59967 is an authorization bypass vulnerability in Tandoor Recipes prior to version 2.6.10. The flaw allows an authenticated member of a shared Space to access and delete another member's pending bookmarklet import by submitting the victim's bookmarklet identifier to the POST /api/recipe-from-source/ endpoint. This results in disclosure of private captured page content and destruction of the victim's pending import. The issue is fixed in version 2.6.10.
CVE-2026-49868 is a critical out-of-bounds read vulnerability in RIOT-OS affecting versions prior to 2026.07. The flaw occurs in the DHCPv6 client implementation where minimum-length validation is missing before parsing IA_PD and IA_NA option bodies. A malicious DHCPv6 server can exploit this by sending a reply with an option length smaller than expected, leading to heap memory reads beyond the option boundary. This can cause device crashes and potential memory exposure or corruption. The issue is fixed in version 2026.07.
CVE-2026-102693 is a critical buffer overflow vulnerability in the RIOT-OS microcontroller operating system affecting versions prior to 2026.04. The flaw exists in the ATWINC15x0 driver's _atwinc15x0_sta_set_current_ssid function, which uses strcpy to copy an SSID without validating the destination buffer size. When the MODULE_ATWINC15X0_DYNAMIC_CONNECT feature is enabled, an attacker within Wi-Fi range can send a malformed or oversized SSID during scanning, leading to memory corruption. This can cause a hard fault, denial of service, or potentially allow code execution. The vulnerability is fixed in RIOT-OS version 2026.04.
CVE-2026-102692 is a critical integer overflow vulnerability in the RIOT-OS microcontroller operating system affecting versions prior to 2026.07. It arises from the nanocoap module accepting oversized CoAP Block2 option values without enforcing the 20-bit maximum block number limit. This allows block offset multiplication to overflow on 32-bit targets, leading to invalid slice ranges. A remote CoAP client can exploit this by sending a malformed Block2 option, potentially causing out-of-bounds memory access, denial of service, or memory corruption. The vulnerability is fixed in version 2026.07.
PeerBanHelper versions 5.0.0 through 9.3.14 contain an SQL injection vulnerability in the /api/statistic/analysis/field endpoint. Authenticated users can exploit this by supplying a crafted field parameter that is not properly sanitized, enabling unauthorized reading of all data in the PeerBanHelper database. The vulnerability is fixed in version 9.3.15.
MariaDB server versions from 10.6.1 up to but not including 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, and 13.0.1 up to 13.0.2 are affected by an SQL injection vulnerability. The issue arises because SHOW CREATE SERVER, SHOW CREATE USER, and mariadb-dump commands do not consistently quote identifiers and values when serializing SQL, allowing a low-privileged attacker to inject SQL commands via crafted object identifiers or values. This vulnerability is fixed in the stated versions 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2.
A buffer over-read vulnerability exists in MariaDB server's ST_Area function when processing invalid WKB for MultiPolygon geometries. This occurs because the multi-polygon parser advances past a nested geometry header without verifying sufficient input remains. The flaw affects multiple MariaDB versions from 10.6.1 up to but not including 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, and 13.0.1 up to 13.0.2. A low-privileged remote attacker can exploit this to disclose memory, potentially aiding in bypassing ASLR as part of a multi-vulnerability attack chain. The issue has been fixed in the stated fixed versions.
A use-after-free vulnerability (CWE-416) exists in MariaDB server versions 12.3.1 through before 12.3.3 and 13.0.1 through before 13.0.2 in the handling of SYS_REFCURSOR. This flaw allows a low-privileged attacker to open many SYS_REFCURSORs and trigger a use-after-free condition, potentially enabling remote code execution when combined with another vulnerability. The issue is fixed in versions 12.3.3 and 13.0.2.
CVE-2026-85746 is a critical out-of-bounds write vulnerability in the MariaDB server affecting multiple versions from 10.6.1 up to but not including 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. The flaw occurs in the ST_AsText function when converting deeply nested GeometryCollections, where recursive WKT serialization fails to properly account for buffer size, leading to memory corruption. A low-privileged remote attacker can exploit this to potentially achieve code execution when combined with another vulnerability. The issue is fixed in the specified later versions.
CVE-2026-92262 is a critical vulnerability in MariaDB server affecting multiple versions from 10.6.1 up to but not including 10.6.28, 10.11.19, 11.4.13, 11.8.9, 12.3.3, and 13.0.2. It involves the #mysql50# prefix bypassing normal table-name filesystem encoding, allowing attackers to access files using legacy unencoded names. This can lead to crashes, data corruption, data exfiltration, or remote code execution. The issue is fixed in the specified later versions.
MariaDB server versions from 10.6.1 up to but not including 10.6.28, 10.11.1 up to 10.11.19, 11.4.1 up to 11.4.13, 11.8.1 up to 11.8.9, 12.3.1 up to 12.3.3, and 13.0.1 up to 13.0.2 contain a vulnerability in the GRANT PROXY statement. This flaw allows a low-privileged attacker who can name another account to change that account's password due to improper handling of an IDENTIFIED clause with an empty password. The issue is fixed in later versions.
A missing authorization vulnerability exists in the MariaDB server's CONNECT engine plugin file-access UDFs (json_file(), bson_file(), jfile_make(), bfile_make(), and jbin_file()) in certain versions. These functions do not enforce the FILE privilege or the secure_file_priv setting, allowing a low-privileged attacker to read or write files on the filesystem that the database account is not authorized to access, subject to OS permissions. The issue affects multiple MariaDB versions and has been fixed in later releases.
Dockhand, a Docker management application by Finsys, has a critical vulnerability (CVE-2026-57169) affecting versions prior to 1.0.34. The flaw is due to missing authentication on the WebSocket upgrade request for the in-browser container terminal endpoint, allowing unauthenticated attackers with network access and container ID knowledge to execute commands inside containers. This can lead to full container compromise and potentially the host if privileged or sensitive mounts are present. The vulnerability is fixed in version 1.0.34.
CVE-2026-77474 is a high-severity vulnerability in destructive_command_guard (dcg), a command-line safety tool that blocks destructive shell commands before AI coding agents execute them. Versions prior to 0.6.6 are affected by uncontrolled resource consumption due to recursive rescanning triggered by nested or unclosed substitution sequences like $( or $((. This leads to exponential-time processing and can cause the PreToolUse hook to hang and fail open, allowing destructive commands to proceed. The issue is fixed in version 0.6.6.
CVE-2026-44977 is a critical cross-site scripting (XSS) vulnerability in the Countly countly-server product analytics solution. The flaw exists in the star-rating plugin's API and frontend components prior to versions 24.05.50 and 25.03.44. It allows a non-global application administrator to upload attacker-controlled active content with a trusted MIME type, which is then served with the attacker-influenced Content-Type. When a global administrator previews this content, the malicious payload executes in the Countly origin, exposing authenticated session tokens including auth_token and csrf_token. This vulnerability has a CVSS score of 9.0 and is fixed in the specified versions.
CVE-2026-41582 is a path traversal vulnerability in countly-server, the server-side component of the Countly analytics platform. Versions prior to 24.05.50 and 25.03.44 allow unauthenticated attackers to traverse outside intended asset directories via certain public image and screenshot routes. This can lead to disclosure of arbitrary readable server files. The issue is fixed in versions 24.05.50 and 25.03.44.
CVE-2026-42270 is a vulnerability in countly-server, the server-side component of the Countly analytics platform. Prior to versions 24.05.50 and 25.03.44, certain public image and screenshot routes use local filesystem storage and call getStream to pipe filesystem streams to HTTP responses without an error listener. An unauthenticated request with a URL-encoded dot can cause createReadStream to open a directory, triggering an asynchronous EISDIR error that is unhandled, leading to termination of the Node.js process. This results in denial of service by making the analytics API unavailable. The issue affects routes such as star-rating/images/, dashboards/images/screenshots/, /appimages/*, /memberimages/*, and */screenshots/*. The vulnerability is fixed in versions 24.05.50 and 25.03.44.
This analysis discusses the risk management considerations for deploying open-weight AI models in enterprise environments. Open-weight models provide enterprises with access to model weights, enabling inspection, evaluation, modification, and local deployment. However, this flexibility introduces complexities in risk evaluation and safeguard responsibilities. Microsoft and NVIDIA have published a joint paper introducing a risk taxonomy and management approach based on established standards such as ISO and NIST frameworks. The taxonomy categorizes risks into Cybersecurity, Data Protection, Content, Human-AI Interaction, and Bias. The guidance emphasizes that risk depends on the model, use case, deployment context, and safeguards rather than weight openness alone. Enterprises are encouraged to adapt the taxonomy to their specific scenarios and use evaluations as evidence to manage risks effectively. The paper focuses primarily on model-layer risks and highlights the need for ongoing assessment of controls as models and deployments evolve.
CVE-2026-42269 is a path traversal vulnerability in countly-server's data migration deletion route that allows authenticated users with migration permissions to delete arbitrary writable files or directories. This occurs because the exportid parameter is not properly validated before being used in file path operations. The issue is fixed in versions 24.05.50 and 25.03.44.
CVE-2026-102923 is a server-side request forgery (SSRF) vulnerability in CodeWithCJ SparkyFitness, a self-hosted AI-powered health and fitness tracker. Versions prior to 1.6.0 improperly validate custom AI service URLs set by authenticated users, allowing crafted outbound POST requests with controlled bearer tokens. This can enable probing of internal services and disclosure of AI system prompts. The vulnerability is fixed in version 1.6.0.