Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, the Tenant update validation in internal/webhook/tenant/validation/forbidden_annotations_regex.go compiles ForbiddenLabels.Regex for both the labels and annotations checks instead of validating ForbiddenAnnotations.Regex. An administrator who can update a Tenant can therefore persist a malformed ForbiddenAnnotations.Regex while leaving the labels expression valid. Namespace creation or update later passes the stored expression through pkg/api/forbidden_list.go, where regexp.MustCompile can panic during forbidden metadata validation and deny namespace operations for the affected tenant. This issue is fixed in version 0.13.7.
CVE-2026-93567 is a vulnerability in Netty's HTTP/2 codec used by Red Hat Build of Apache Camel 3.33.3.SP2. It involves improper input validation where HTTP/1 CONNECT requests are incorrectly converted to HTTP/2 CONNECT requests by using the Host header instead of the CONNECT authority-form request-target. This allows attackers to manipulate the Host header to create malformed HTTP/2 CONNECT requests that can bypass tunnel allow-lists and egress policies, potentially compromising integrity. The vulnerability has a CVSS score of 7.5, indicating medium severity. A security update is available from Red Hat as part of the Quarkus 3.33.3.SP2 release. No known exploits in the wild have been reported.
CVE-2026-93568 is a vulnerability in Netty where specially crafted HTTP/2 or HTTP/3 Extended CONNECT requests are incorrectly processed as HTTP/1.1 CONNECT requests. This leads to loss of critical protocol and path information, potentially allowing authorization bypasses in applications relying on Netty for HTTP/2 or HTTP/3 communication. The vulnerability has a CVSS score of 7.5, rated as high severity. Red Hat has issued a security advisory for Red Hat build of Quarkus 3.33.3.SP2 that includes a fix for this issue. Users are advised to apply the update according to vendor guidance.
A file type attribution issue in Zscaler Internet Access File Type Control evaluation rules may allow improper evaluation of File Type Control policies in rare circumstances.
Mapster WP Maps plugin for WordPress versions up to and including 1.23.0 contains an improper input validation vulnerability in the my_profile_update() function. This flaw allows authenticated users with Subscriber-level access or higher to update arbitrary user meta values without nonce verification, capability checks, or allowlist validation. Although this can lead to modification of user metadata, privilege escalation is not possible. The vulnerability has a high severity score of 8.8 CVSS 3.1.
ManageEngine DataSecurity Plus versions before 6310 are vulnerable to an agent authentication bypass, allowing unenrolled agents to send requests without proper authentication.
Browsertrix is a high-fidelity, browser-based crawling service for web archiving that can be self-hosted or used through Webrecorder's hosted instance. From 1.15.0 until 1.22.8, Browsertrix improperly sanitizes Git URLs specified as Custom Behaviors, allowing command injection through /api/orgs/*/crawlconfigs/validate/custom-behavior. A user with crawler or administrator permission on the specific instance can supply a crafted Git URL that executes arbitrary operating-system commands in the backend pod. Open registration or hosted free-trial access can make the required role broadly obtainable. Successful exploitation can expose, modify, or delete application database records, archived items, browser profiles, storage data, proxy credentials, and other configured service data. This issue is fixed in version 1.22.8.
CVE-2026-45723 is an improper input validation vulnerability in siderolabs omni prior to versions 1.6.6 and 1.7.3. An authenticated Operator can manipulate the TalosVersion field to cause the application to issue HTTP GET requests to unintended paths on the configured image-factory host. This can lead to same-host endpoint probing and possible disclosure of internal diagnostic information. The vulnerability does not allow redirection to other hosts or write operations. The issue is fixed in versions 1.6.6 and 1.7.3.
mport is the MidnightBSD Package Manager. Prior to 2.7.8, the audit command in mport/mport.c computed option-adjusted local_argv and local_argc values but passed the original argument entry to audit_package(). When an operator or automation used an option such as -r before a package name, stale optind state and the unadjusted argument could cause mport to audit the option token instead of the requested package, producing a false-negative or useless result that could leave a vulnerable package unidentified. The corrected parsing resets optind and optreset before using the adjusted local arguments. This issue is fixed in version 2.7.8.
Nuxt OG Image generates OG Images with Vue templates in Nuxt. From 6.0.2 until 6.7.0, nuxt-og-image exposes the unauthenticated /_og/d/** route when the documented defaults security.strict = false and security.secret = "" are used, and base64url-decodes the fonts parameter through decodeOgImageParams. Attacker-controlled fonts[].path values flow through loadDefinedFonts into the font-assets/node.js binding, which performs a server-side fetch without validating the URL scheme, origin, resolved address, or redirects. This permits blind requests to loopback, private, link-local, cloud metadata, and other internal HTTP services, while differences in the outer response status and timing can reveal service reachability. Slow targets can also occupy OG image render workers for the configured fetch and render timeouts. This issue is fixed in version 6.7.0.
HAPI FHIR versions prior to 6.9.12 contain an improper input validation vulnerability in the SHCParser component. This flaw can cause an infinite loop when processing specially crafted Smart Health Card JWTs with a 'zip' header set to 'DEF' and an empty or truncated raw-DEFLATE payload. The infinite loop can indefinitely pin a JVM worker thread, potentially exhausting all validation workers under concurrent requests. This issue is fixed in version 6.9.12.
CVE-2026-81875 is a high-severity vulnerability in HAPI FHIR's org.hl7.fhir.core component prior to version 6.9.12. The SHCParser improperly validates input when decompressing Smart Health Card JWT content with a 'zip' header set to 'DEF'. This leads to unbounded memory allocation during decompression, potentially causing excessive heap usage, severe garbage collection pressure, request failures, or process crashes. The issue is fixed in version 6.9.12.
CVE-2026-90999 is a critical vulnerability in Functional Software, Inc.'s Sentry Seer that involves improper input validation. This flaw allows an unauthenticated attacker to submit malicious telemetry data that is subsequently executed as code by a privileged automation agent. The attacker does not need access to the victim's Sentry account, source repository, or infrastructure to exploit this issue.
On affected platforms running Arista EOS, an unauthenticated attacker who is network-adjacent to the switch and able to connect to a device with PIM Sparse Mode and MLAG configured, can send malformed messages that cause the Pimsm agent to terminate unexpectedly. The Pimsm agent is automatically restarted, but repeated attacks can cause the agent to restart continuously, resulting in a sustained denial of service.
On affected platforms running Arista EOS, an issue with the gRPC Network Security Interface (gNSI) Authz Rotate RPC may cause an incorrect Authz policy which was uploaded in the ongoing RPC stream to become active. This does not affect Bootz.
This issue was discovered internally by Arista and the company is not aware of any malicious uses of this issue in customer networks.
The Appointment Hour Booking WordPress plugin before 1.5.95 does not check every appointment in a booking submission against the capacity configured for its own slot, allowing unauthenticated visitors to take slots that are already fully booked.
CVE-2026-19655 is a medium severity vulnerability in Arista Networks EOS affecting versions 4.33.0 through before 4.33.10M, 4.34.0 through before 4.34.8M, and 4.35.0 through before 4.35.6M. It involves improper input validation in the DHCP relay/snooping feature when configured with the information option (Option 82). An unauthenticated attacker on a client-facing VLAN where DHCP relay is configured can send a crafted packet that causes the DHCP Relay service to restart, resulting in denial of service.
CVE-2026-56831 is an improper input validation vulnerability in shopperlabs shopper versions prior to 2.9.0. The administrative discounts interface accepts negative fixed_amount discount values, which are persisted and used in price calculations without enforcing that discounts be positive. This flaw causes negative discounts to increase order totals instead of reducing them, leading to incorrect pricing and financial data integrity issues. The vulnerability is fixed in version 2.9.0.
CVE-2026-88261 is an improper input validation vulnerability in bizwell xClick that allows stored cross-site scripting (XSS). The issue affects specific versions labeled R2 and R3. This vulnerability has a medium severity rating with a CVSS 4.0 base score of 5.1.