Starlet versions from 0.20 up to but not including 0.33 for Perl contain a vulnerability that allows remote attackers to exhaust memory via unbounded buffering when decoding chunked request bodies. The vulnerability arises because the decoder accumulates input in a buffer without limiting the length of chunk-size lines or the data of large chunks, enabling a single request to consume excessive memory.
Dell OpenManage Enterprise versions prior to 4.8.0 contain an Insufficiently Protected Credentials vulnerability (CVE-2026-111502). This flaw allows a low privileged attacker with remote access to potentially disclose sensitive information. The vulnerability does not affect integrity or availability but impacts confidentiality. The CVSS score is 4.3 (medium severity).
CallBackery versions prior to 0.60.1 for Perl contain a path traversal vulnerability in the /doc route that allows unauthenticated clients to read the POD (Plain Old Documentation) of any file accessible by the server process. This occurs because the documentation plugin mounted at /doc does not validate input before passing it to Pod::Simple::Search->find, enabling traversal outside the intended directories.
Starlet versions from 0.20 up to but not including 0.33 for Perl contain a vulnerability that allows CPU exhaustion via regular expression backtracking when decoding chunked request bodies. The flaw arises because the chunk-size line matching can cause the regex engine to retry matches quadratically with the length of the input, and there is no limit on the length of the run. A remote attacker can exploit this by sending a specially crafted 128 KiB request, causing a worker to consume about a minute of CPU time.
FOSSBilling versions before 0.8.9 have a Cross-Site Request Forgery (CSRF) vulnerability in the staff guest login endpoint. This flaw allows remote attackers to force authentication by exploiting missing CSRF or Origin validation on the staff_login action. An attacker can craft an auto-submitting HTML form with attacker-controlled credentials to silently log a victim's browser into the attacker's staff account.
Starlet versions before 0.33 for Perl improperly send a body in responses to HEAD requests, causing corruption of subsequent responses on persistent or pipelined HTTP connections. This occurs because the request method is not passed to the response writer, resulting in unintended body content being sent. This behavior can desynchronize clients or proxies sharing the connection.
In the Linux kernel, the following vulnerability has been resolved:
net/sched: act_api: fix TOCTOU NULL deref on a->goto_chain
tcf_action_exec() handles TC_ACT_GOTO_CHAIN by first checking
rcu_access_pointer(a->goto_chain) and then calling
tcf_action_goto_chain_exec(), which does a second, independent
rcu_dereference_bh(a->goto_chain) read and immediately dereferences
chain->filter_chain. A concurrent tcf_action_set_ctrlact() (e.g. the gact
replace path) can clear a->goto_chain between the two reads, so the second
read returns NULL and tcf_action_goto_chain_exec() dereferences NULL.
Fix the race by doing a single rcu_dereference_bh() read of a->goto_chain
in tcf_action_exec(), checking it once for NULL, and passing the resulting
chain pointer into tcf_action_goto_chain_exec(). This turns the split
check/use into a single check/use on one value.
The npm package 'tabby-fknat' version 0.1.2 contains malicious code that can fully compromise any computer on which it is installed or running. This compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package is advised, but due to the extent of the compromise, complete remediation may require rotating all secrets and keys from a different, trusted machine.
RTIR extends RT's HTML scrubber to allow an internal link
placeholder, and the extension lets through any link that merely
contains the placeholder, including links using the executable
javascript: scheme. The change applies to the whole RT instance
once RTIR is installed, not only to RTIR's own queues. Anyone who
can add HTML content to a ticket on such an instance can store
such a link. That includes an unauthenticated sender of HTML email
to the Incident Reports queue, which RTIR opens to everyone by
default. Script runs when a user clicks the link, in that user's
session, and can act in RT with that user's authority.
This issue was fixed in version 5.0.11 and 6.0.4
Blender before 4.5.15 and 5.x before 5.2.3 contains a heap out-of-bounds access vulnerability in read_struct() that skips size validation when a .blend file's SDNA struct layout compares equal. Attackers can supply a crafted .blend file with short blocks so field reads, writes, and pointer dereferences overrun heap memory, causing crashes or code execution.
Blender before 4.5.15 and 5.x before 5.2.3 contains an out-of-bounds read vulnerability in blo_bhead_id_* accessors in readfile.cc that read ID fields without block length checks. Attackers can supply a crafted .blend file with short ID blocks that, when browsed or appended from, causes heap over-reads leading to crashes or heap memory disclosure.
CVE-2026-119720 is a heap out-of-bounds read vulnerability in Blender versions before 4.5.15 and 5.x before 5.2.3. It occurs in the read_file_dna() function when processing a crafted .blend file with a truncated GLOB block, leading to a crash.
Blender versions before 4.5.15 and 5.x before 5.2.3 have a heap buffer overflow vulnerability in the blend file thumbnail extractor. This is caused by a 32-bit integer overflow in the thumb_data_vertical_flip() function. Maliciously crafted .blend files with specially designed TEST block dimensions can trigger out-of-bounds writes when previewed by blender-thumbnailer or the Windows shell extension, potentially leading to crashes or code execution.
Blender versions before 4.5.15 and 5.x before 5.2.3 have a heap buffer overflow vulnerability due to an integer overflow in the ptcache_data_alloc() function when reading point cache files. An attacker can craft a malicious point cache file with a large totpoint value alongside a .blend file to cause a crash or potentially execute arbitrary code with user privileges.
pybars4 through 0.9.13 contains a code injection vulnerability in pybars/_compiler.py that allows attackers to execute Python code via unescaped bracketed path segments in Handlebars templates. Attackers can supply a template with a crafted segment in a helper or block argument to break out of the generated resolve() string literal and execute code in the application process.
pybars3 versions up to 0.9.7 have a critical code injection vulnerability in the pybars/_compiler.py component. This flaw allows template authors to execute arbitrary Python code by supplying crafted Handlebars templates with unescaped bracketed path segments. Exploitation requires supplying malicious segments in helper or block arguments to break out of string literals and run Python code within the application process.
NocoDB versions prior to 2026.08.0 have a clickjacking vulnerability due to missing X-Frame-Options and CSP frame-ancestors headers. This allows attackers to embed the authenticated interface in a frame on a malicious site, potentially tricking signed-in users into performing unintended actions such as modifying or deleting records, changing sharing settings, or inviting collaborators.
The My Calendar WordPress plugin versions 3.8.8 through 3.8.10 contain a shortcode injection vulnerability. This flaw allows unauthenticated attackers to execute registered shortcodes via the 'mcs' search parameter, leading to potential content injection and spoofing on any page or post. The vulnerability is fixed in version 3.8.11.
Paperclip 2026.403.0 before 2026.416.0 contains a remote code execution vulnerability that allows agent API key holders to set cleanupCommand and teardownCommand via PATCH /api/execution-workspaces/:id. When the workspace is archived, cleanupExecutionWorkspaceArtifacts runs these commands through a shell as the Paperclip server process, executing attacker-chosen OS commands on the server host.