Exposure of PII in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to leak GDPR protected user information.
CVE-2026-123180 is a missing authentication vulnerability in the NETGEAR RAX30 router models before version 1.0.15.110. An attacker who is adjacent on the network and has authenticated to the Wi-Fi network can access sensitive information and modify device configuration, including administrator credentials, without further authentication. This vulnerability impacts the confidentiality, integrity, and availability of the device.
CVE-2026-123178 is an input validation vulnerability in the NETGEAR Orbi RBR350 router that allows an authenticated administrator on the local network to execute unauthorized commands and modify the router's software and functionality. This flaw affects versions prior to 4.4.3.4 and could compromise the device's integrity. The vulnerability has a medium severity rating and a CVSS 4.3 score. A fix is available in version 4.4.3.4.
An exposed dangerous function in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a local authenticated attacker to trigger a denial of service.
Argument injection in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to delete arbitrary files on disk.
A DOM-based Cross-Site Scripting (XSS) vulnerability exists in the OHIF Viewers' dicom-pdf extension when rendering Encapsulated PDF DICOM objects. The vulnerability arises from improper validation of the MIMETypeOfEncapsulatedDocument tag, allowing an attacker to control the MIME type of a Blob URL. This can lead to execution of attacker-supplied JavaScript in the context of the OHIF application origin when the victim opens a specially crafted DICOM study. The flaw affects versions prior to 3.12.18, 3.13.10, and 3.14.0-beta.36, with patches available in these and later versions.
A vulnerability in node-forge prior to version 1.4.1 causes certificate signature verification to use the issuer certificate's RSA signature scheme instead of the certificate's own declared signature algorithm. This allows a certificate labeled as signed with RSASSA-PSS to be accepted if the issuer used PKCS#1 v1.5, despite the signature actually being PKCS#1 v1.5. The flaw does not allow forging certificates but can cause incorrect acceptance or rejection of certificate chains. The issue is fixed in node-forge 1.4.1.
A vulnerability in node-forge versions prior to 1.4.1 causes incomplete validation of PKCS#7 padding during AES and DES decryption in CBC and ECB modes. The decryption function only checked the last padding byte and allowed malformed padding, including zero counts and oversized counts, which could silently remove up to four blocks of plaintext. This flaw was fixed in node-forge 1.4.1 by enforcing strict PKCS#7 padding validation. The vulnerability does not affect confidentiality or availability but could allow attackers to manipulate ciphertext to cause silent plaintext truncation. Applications decrypting untrusted data with CBC or ECB mode should authenticate ciphertext or use authenticated encryption modes like AES-GCM.
A vulnerability in node-forge's pki.verifyCertificateChain() function causes it to ignore the pathLenConstraint in CA certificates that lack a keyUsage extension. This allows certificate chains with more intermediate CAs than allowed by the pathLenConstraint to be accepted. The issue is fixed in node-forge 1.4.1.
The node-forge library's asn1.fromDer() function decodes BIT STRING contents as ASN.1 by default but fails to enforce the maxDepth recursion limit properly, allowing crafted DER or PEM inputs with deeply nested BIT STRINGs to cause excessive CPU and memory consumption. This can lead to denial of service by aborting the Node.js process due to heap exhaustion. The issue is fixed in node-forge version 1.4.1 by enforcing the maxDepth limit and decoding only one level of BIT STRING contents.
Improper input validation in Ivanti EPMM before version 12.11.0.0, 12.10.0.1, and 12.9.0.3 allows a remote authenticated attacker with admin privileges to permanently disable all Apache HTTPS services resulting in denial of service.
A vulnerability in node-forge before version 1.4.1 allows RSA PKCS#1 v1.5 signature forgery due to acceptance of non-canonical BER encodings of the DigestInfo during signature verification. This flaw affects verification of signatures using RSA keys with a low public exponent (e=3), enabling attackers to forge signatures without the private key. The issue is fixed in node-forge 1.4.1 by enforcing strict DER encoding checks on DigestInfo.
A vulnerability in the @effect/platform library's makeCookie() function allows injection of cookie attributes via the name, domain, and path fields. These fields were validated with a regex that permitted the ';' character, enabling attackers to append arbitrary attributes to Set-Cookie headers. This can lead to unintended cookie scope expansion or attribute manipulation. The value field is safe due to encoding, and header splitting is not possible. The issue is fixed in versions 0.97.1 and 4.0.0-beta.103.
OctoPrint versions from 2.0.0rc1 up to but not including 2.0.0rc7 contain a stored cross-site scripting (XSS) vulnerability in the Serial Connector plugin. This occurs via specially crafted default 'port' or 'baudrate' settings supplied through the API during a connect request. The vulnerability is patched in version 2.0.0rc7. Users should check their configuration files for malicious JavaScript fragments and remove them as a workaround.
Altair versions from 7.2.4 up to but not including 8.5.8 contain a DOM-based cross-site scripting (XSS) vulnerability in the iframe sandbox plugin configuration. The vulnerability arises because the sandbox page accepts plugin configuration from the iframe sandbox query string and injects attacker-controlled script URLs without proper origin isolation if the sandbox URL is opened directly. This allows arbitrary JavaScript execution in the Altair hosting origin when a victim opens a crafted URL. The issue is fixed in version 8.5.8.
bitcoinjs-lib versions prior to 5.2.1, 6.1.8, and 7.0.2 contain a vulnerability (CVE-2026-107846) where the fastMerkleRoot function does not detect duplicated transactions used to pad odd levels in the Merkle tree. This allows a forged block with a different transaction list but the same Merkle root and block ID to be accepted by the library's checkTxRoots function. Bitcoin Core mitigates this by detecting such mutations and rejecting the block, but bitcoinjs-lib lacks this check.
compose-lint version 0.32.0 contains an incomplete fix for a previous secret exposure vulnerability (GHSA-jf3h-8jvx-vcrg). When a run exceeds 20,000 findings, the process stops before masking secret values, causing secrets from a sibling .env file to be exposed in output formats including text logs, JSON, and SARIF reports. This can occur in CI workflows that write secrets into the .env file beside the Compose file and lint pull requests from untrusted authors. No fixed release was available at the time of disclosure, but version 0.33.0 addresses this issue.
GPUStack versions 2.2.0 up to but not including 2.2.2 contain an authorization bypass vulnerability in the Kubernetes API proxy. Authenticated non-administrative users can access Kubernetes clusters they are not authorized for by exploiting missing resource-level authorization checks. This allows attackers to read, modify, or delete Kubernetes resources depending on the permissions of the worker's ServiceAccount, potentially leading to code execution in the target cluster. The issue is fixed in version 2.2.2.
SandboxShellTool in ag2 versions >=0.13.2 and <1.1.1 allows bypassing command restrictions by embedding newline characters in commands. The tool's filter does not recognize newlines as shell operators, enabling execution of arbitrary shell commands via 'sh -c' despite configured allowlists or readonly restrictions. This leads to full host command execution, not sandboxed, posing a high-severity risk. The issue is fixed in version 1.1.1.