A critical vulnerability in the CreditNirvana Collections Platform's login service allows unauthenticated remote attackers to bypass authentication and authorization controls. Exploitation enables attackers to enumerate users, impersonate arbitrary users including administrators, and access or modify sensitive data with the privileges of the impersonated accounts.
The CreditNirvana Agentic AI Call Centre application contains a vulnerability due to a hardcoded static API key embedded in the client-side JavaScript bundle. This allows an unauthenticated remote attacker to extract the API key by downloading the JavaScript files. With the extracted key, the attacker could make arbitrary API calls to access sensitive call transcripts and recordings through the application's API.
An out-of-bounds read vulnerability exists in the QCborValue::fromCbor() function of the Qt Framework. This flaw could potentially allow reading memory outside the intended buffer boundaries. The vulnerability has a medium severity rating with a CVSS score of 5.8. No affected versions or patch information are currently provided.
CVE-2026-107656 is a critical authentication bypass vulnerability affecting multiple versions of Fortinet FortiSandbox and FortiSandbox PaaS. The flaw allows an attacker to execute unauthorized code or commands by sending specially crafted HTTP requests. The affected versions include FortiSandbox 5.0.0 through 5.0.6, 4.4.0 through 4.4.9, all versions of 4.2, and corresponding FortiSandbox PaaS versions. The vulnerability has a high CVSS score of 9.8, indicating severe impact on confidentiality, integrity, and availability.
NexoPOS version 6.2.4 contains a critical directory traversal vulnerability in its api/update endpoint. This flaw allows an attacker to access files and directories outside the intended scope, potentially leading to full system compromise. The vulnerability has a CVSS score of 9.8, indicating high severity with impacts on confidentiality, integrity, and availability.
OpenHands Software Agent SDK versions before 1.52.0 have a critical unauthenticated remote code execution vulnerability. The DockerWorkspace and Apptainer workspace launchers bind the sandbox agent server to all network interfaces (0.0.0.0) with no authentication enabled by default. This allows attackers who can access the container port to execute arbitrary shell commands as root, access mounted workspaces, and read plaintext secrets.
CVE-2026-116367 is a medium severity vulnerability in DeepSeek Harness versions 0.1.0-rc.0 through 0.1.0-rc.5. It affects the createContext function in the sandbox.ts file, resulting in a sandbox issue that can be exploited remotely. The vendor has not responded to disclosure attempts, and no patch or fix information is currently available.
A security vulnerability (CVE-2026-49825) was identified in the python-lxml library's HTML cleaner component, where a missing xlink:href attribute allows a URL bypass. This issue affects Red Hat Enterprise Linux 7 Extended Lifecycle Support versions. Red Hat has issued an important security update to address this vulnerability.
Security Fix(es):
* golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate
certificates (CVE-2026-111943)
* golang: golang crypto/x509: Denial of Service via excessive processing of
DNS SAN entries (CVE-2026-27145)
* golang: Go encoding/asn1: Denial of Service via excessive recursion in
Unmarshal (CVE-2026-33818)
* golang: Golang MIME: Denial of Service via maliciously-crafted MIME
header (CVE-2026-42504)
* golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial
of Service (CVE-2026-56853)
* golang: Go html/template: Cross-Site Scripting via pathological input
(CVE-2026-56858)
* golang: golang net/url: Denial of Service from quadratic complexity in
path resolution (CVE-2026-56860)
* golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate
messages (CVE-2026-56862)
* golang: golang: Denial of Service via crafted HTTP Range headers
(CVE-2026-78667)
* net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of
Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
* golang: crypto/tls: Denial of Service via multiple ECH outer extension
references (CVE-2026-97031)
* golang: Denial of Service via memory limit bypass in multipart form parsing (CVE-2026-94440)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page listed in the References section.
**UNSUPPORTED WHEN ASSIGNED** Authorization bypass in Apache Vysper, all versions.
Apache Vysper is an XMPP (Jabber) server library. Its XEP-0077 (In-Band Registration) implementation is missing an authentication check, allowing any authenticated user to compromise other accounts.
As this project is retired, we do not plan to release a version that fixes this issue. Users are recommended to find an alternative.
CVE-2026-115721 is a high-severity vulnerability in Apache Vysper, an XMPP server library. It involves unbounded resource allocation during XML parsing, which can lead to an out-of-memory condition. This affects all versions of Apache Vysper. The project is retired and no fixes will be released. Users are advised to migrate to alternative solutions.
Red Hat OpenStack Platform provides the facilities for building, deploying and monitoring a private or public infrastructure-as-a-service (IaaS) cloud running on commonly available physical hardware.
Security Fix(es):
* golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate
certificates (CVE-2026-111943)
* net/url: Memory exhaustion in query parameter parsing in net/url
(CVE-2025-61726)
* Incorrect parsing of IPv6 host literals in net/url (CVE-2026-25679)
* golang: golang crypto/x509: Denial of Service via excessive processing of
DNS SAN entries (CVE-2026-27145)
* crypto/tls: golang: Go: Denial of Service vulnerability in certificate
chain building (CVE-2026-32280)
* golang: Go crypto/tls: Denial of Service via multiple TLS 1.3 key update
messages (CVE-2026-32283)
* golang: Go net package: Denial of Service via long CNAME response in
LookupCNAME (CVE-2026-33811)
* golang: Go encoding/asn1: Denial of Service via excessive recursion in
Unmarshal (CVE-2026-33818)
* golang: net/http: golang.org/x/net/idna: Privilege escalation via
incorrect Punycode label processing (CVE-2026-39821)
* golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial
of Service (CVE-2026-56853)
* golang: Go html/template: Cross-Site Scripting via pathological input
(CVE-2026-56858)
* golang: golang net/url: Denial of Service from quadratic complexity in
path resolution (CVE-2026-56860)
* golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate
messages (CVE-2026-56862)
* etcd: Denial of Service via unbounded TLS handshake goroutines
(CVE-2026-73500)
* net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of
Service via excessive HTTP/2 SETTINGS frames (CVE-2026-78669)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page listed in the References section.
Git Large File Storage (LFS) replaces large files such as audio samples, videos, datasets, and graphics with text pointers inside Git, while storing the file contents on a remote server.
Security Fix(es):
* crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates (CVE-2026-111943)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Open5GS 2.6.1 through 2.8.0 contains an out-of-bounds read vulnerability in parse_scheme_output() in lib/sbi/conv.c during SUCI de-concealment due to incomplete length validation. Remote unauthenticated UEs or SBI peers can submit a crafted SUCI with a 42-byte scheme output to a UDM, triggering a heap over-read past the buffer.
Open5GS versions 1.3.0 through 2.8.0 have a heap out-of-bounds write vulnerability in the parse_multipart() function. This flaw allows unauthenticated attackers to corrupt memory by sending a crafted multipart/related request with an empty multipart boundary to the SBI interface of any network function, causing a buffer overflow and potential crash.
CVE-2026-116542 is a vulnerability in netty-tcnative versions before 2.0.84.Final that allows remote unauthenticated clients to spoof SNI hostnames by exploiting improper handling of Unicode encoding in JNI NewStringUTF decoding. Attackers can use overlong encodings in the ClientHello server_name field to manipulate SNI-based certificate selection, access control decisions, and logging.
Netty netty-tcnative before 2.0.84.Final contains a denial of service vulnerability in the tcn_write_to_bytebuffer BIO write callback that overreports bytes consumed. Remote TLS 1.3 peers can provoke queued post-handshake records like NewSessionTicket or KeyUpdate to truncate flights, fail connections, or abort the JVM process.
netty-tcnative 2.0.66.Final before 2.0.84.Final built against OpenSSL 3.x contains a use-after-free vulnerability in ssl_tlsext_ticket_key_cb during session ticket key rotation. Remote clients performing TLS handshakes while setSessionTicketKeys0 frees the shared key array cause OpenSSL to read freed HMAC keys, crashing or corrupting ticket processing.
CVE-2026-116539 is a heap buffer overflow vulnerability in netty-tcnative before version 2.0.84.Final. It occurs in the tcn_write_to_bytebuffer BIO callback due to improper handling of the ring buffer write index. Remote TLS peers can exploit this during handshake, renegotiation, or post-handshake messages to trigger an out-of-bounds memory copy, causing the JVM process to crash.