isomorphic-git versions prior to 1.42.0 contain a prototype pollution vulnerability in the getRemoteInfo function. This flaw allows a malicious Git server operator to manipulate Object.prototype by advertising specially crafted ref names containing '__proto__' segments. Exploitation can cause isomorphic-git to reroute network operations through an attacker-controlled proxy and leak credentials via the onAuth callback when getRemoteInfo is called with a malicious URL. The vulnerability is fixed in version 1.42.0.
UnoPim versions before 2.1.5 have an authenticated file upload vulnerability allowing administrators to upload arbitrary PHP files via the TinyMCE image upload endpoint. This occurs due to missing validation of file extensions and MIME types. Exploiting this, attackers can upload a PHP web shell to public storage and execute arbitrary OS commands on the server by accessing the uploaded file URL.
CVE-2026-82522 is an integer underflow vulnerability in libjxl versions before 0.12.0. It occurs in the container box parser due to 64-bit box size truncation to size_t on 32-bit platforms. This flaw allows remote attackers to inject arbitrary metadata by crafting a malicious JPEG XL file that causes the decoder to misinterpret codestream bytes as phantom box headers. The vulnerability can lead to injection of arbitrary metadata such as Exif, XMP, IPTC, and JUMBF, and may also cause out-of-bounds reads.
Pangolin versions before 1.22.0 have an authentication bypass vulnerability that allows unauthenticated attackers to access any protected resource by manipulating a URL parameter in the share-link authentication endpoint. This flaw enables attackers with a single valid share link to authenticate across different organizations and bypass all configured authentication methods, including SSO, passwords, PINs, email allowlists, and header authentication.
Keploy versions 3.1.0 through 3.6.25 have a missing authentication vulnerability in the agent control-plane HTTP server, which is bound to all interfaces without access controls. This exposes sensitive endpoints that allow attackers to retrieve TLS session keys and manipulate recording sessions. The flaw is fixed in version 3.6.26.
CVE-2026-76840 is a high-severity out-of-bounds write vulnerability in RustDesk's Windows clipboard redirection feature. The flaw occurs because the software copies a peer-supplied length into a fixed-size buffer without properly checking upper bounds, allowing a malicious remote peer to write data beyond the buffer's end during clipboard file content pasting. This vulnerability is similar to a previously fixed defect in FreeRDP and affects RustDesk versions up to 1.4.9.
CVE-2026-78209 is a vulnerability in exceljs up to version 4.4.0 where leading formula characters (=, +, -, @) in CSV cell values are not neutralized. This allows attackers who control exported cell values to inject formulas that execute upon opening the CSV in spreadsheet software, potentially leading to data exfiltration or other malicious actions.
CVE-2026-78208 is a path traversal vulnerability in the exceljs library up to version 4.4.0. The flaw exists in the Workbook.addImage() function, which does not properly validate file paths. This allows attackers to supply arbitrary file paths, potentially reading any file accessible to the Node.js process and embedding its contents into the generated Excel workbook.
CVE-2026-78207 is a critical prototype pollution vulnerability in exceljs versions up to 4.4.0. The flaw exists in the deepMerge helper function, which improperly allows merging of objects containing __proto__, constructor, or prototype keys when processing cell notes. This enables attackers to modify Object.prototype, potentially impacting all plain objects created thereafter.
A vulnerability in exceljs up to version 4.4.0 allows attackers to upload highly compressed XLSX files that decompress into very large sizes in memory without limits. This can exhaust system resources and cause a denial of service.
CVE-2026-77767 is a missing authorization vulnerability in Reconmap's API allowing unauthenticated remote attackers to access sensitive project and client organization information. The vulnerability arises because the report preview action is marked with [AllowAnonymous], bypassing the default admin-only authorization policy. Attackers can enumerate project IDs to retrieve penetration-testing engagement details and client records without authentication or role checks.
OpenEMR versions prior to 8.2.0 contain a path traversal vulnerability in the standard_tables_manage.php interface. This flaw allows an unauthenticated attacker to supply a crafted db parameter that bypasses validation and causes recursive deletion of directories outside the intended temporary directory. The attack can be combined with an open redirect vulnerability to trigger arbitrary recursive directory deletion within an authenticated Superuser's session. The issue is fixed in OpenEMR version 8.2.0.
rConfig versions prior to 8.2.13 contain a path traversal vulnerability in the download_export() method. Authenticated attackers can exploit this flaw by supplying directory traversal sequences in the filename GET parameter to read arbitrary files outside the intended export directory. This can expose sensitive files such as application environment files with encryption keys, database credentials, and mail configuration.
Bash-it version 3.2.0 and earlier contain a terminal escape sequence injection vulnerability in the barbuk theme's Python virtualenv prompt segment. This flaw allows local attackers to inject arbitrary terminal control sequences by embedding escape sequences in the requires-python field of a pyproject.toml file. When a user enters a directory with a malicious pyproject.toml, the crafted field value is read and concatenated directly into the shell prompt without filtering control characters, causing the terminal emulator to interpret injected sequences on every prompt render.
Typemill CMS version 2.x has a persistent cross-site scripting (XSS) vulnerability in its Markdown parser extension. Authenticated users with theme-configuration access can inject malicious JavaScript URIs by supplying unsanitized href values in Markdown links. This allows attackers to craft links using the javascript: scheme, resulting in persistent payloads that execute in the browsers of visitors who click the links. The vulnerability can lead to session cookie theft, authenticated request forgery, and credential harvesting.
ZenML versions up to and including 0.94.6 contain a remote code execution vulnerability in the CloudpickleMaterializer component. This flaw allows attackers with write access to a shared artifact store to execute arbitrary code by replacing a stored artifact.pkl file with a malicious cloudpickle payload. The vulnerability arises from unsanitized deserialization using cloudpickle.load(), which executes the malicious __reduce__ method embedded in the payload.
CVE-2026-5857 is a high-severity out-of-bounds write vulnerability in Contiki-NG's MQTT client. The flaw occurs in the parse_publish_vhdr() function where an over-length MQTT topic causes improper handling of a length flag, leading to a memcpy() operation that overruns a 65-byte buffer. This buffer overflow can overwrite adjacent memory, including a pointer used later by the MQTT code, enabling an attacker controlling the MQTT broker to perform arbitrary pointer writes. The MQTT implementation lacks TLS, so communications are unencrypted. The impact ranges from information disclosure and denial of service to remote code execution on embedded devices without memory protection.
CVE-2026-5856 is an out-of-bounds read vulnerability in Contiki-NG's DNS/mDNS resolver component. The flaw occurs in the skip_name() function, which processes DNS wire-format name labels without proper packet-boundary checks. An attacker can exploit this by sending specially crafted DNS or multicast DNS packets that cause the resolver to read beyond the UDP packet buffer, potentially disclosing memory contents or causing a crash. This vulnerability affects builds with RESOLV_CONF_SUPPORTS_MDNS enabled and standard DNS builds under certain conditions.
CVE-2026-5855 is an out-of-bounds read vulnerability in Contiki-NG's LwM2M TLV parser. The function lwm2m_tlv_read() reads up to six bytes from an input buffer without proper bounds checking, potentially disclosing adjacent heap memory contents. This can leak sensitive information such as key material and peer addresses. The vulnerability can be triggered by a crafted CoAP WRITE request to any LwM2M endpoint with a specially crafted TLV payload. In the default NoSec mode for constrained devices, no authentication is required to exploit this issue.
Gitea versions up to 1.26.4 contain a server-side request forgery (SSRF) vulnerability that allows authenticated users to bypass SSRF protections. This occurs through HTTP fetch operations in migration and OAuth avatar code paths that use Go's default http.Get without custom network controls. Attackers can supply arbitrary URLs to access internal services, cloud metadata endpoints, or local files including sensitive configuration data. Exfiltrated content can be persisted as migration release assets for later retrieval.