A cross-site scripting (XSS) vulnerability exists in Argilla up to version 2.8.0 within the Dataset.from_disk function of the Settings Page component. This flaw allows remote attackers to manipulate the Name argument, potentially leading to XSS attacks. The vulnerability has a low CVSS score of 3.5 and requires user interaction with low privileges. The project has been informed but has not yet responded or issued a fix. Exploit code is publicly available.
Mozilla Thunderbird contains a vulnerability in the libexpat XML parsing library that allows denial of service via crafted XML input (CVE-2026-45186). This security issue is addressed in Thunderbird version 153.5.0-1.el10_2.alma.1 and later. The update also includes bug fixes and enhancements related to the Thunderbird ESR 153 rebase for Red Hat Enterprise Linux 10.2 Extended Update Support.
OpenPanel versions before 3.0.0 have an authorization vulnerability in the onboarding.project tRPC mutation. This flaw allows non-admin organization members to create projects and generate write-type ingestion credentials, bypassing intended admin-only restrictions. Exploitation can lead to exposure of plaintext secrets, injection of fake analytics events, distortion of business metrics, and unauthorized consumption of the organization's usage budget. The vulnerability has a medium severity score of 5.3 and is fixed in OpenPanel version 3.0.0.
A double free vulnerability exists in libyal libmsiecf through version 20260525 in the function libmsiecf_url_values_read_data(). This flaw allows attackers to corrupt heap memory by supplying a crafted MSIE cache index.dat file with an oversized unknown_offset in a partial URL record. The vulnerability can cause forensic tools processing such files to crash. The CVSS 3.1 base score is 5.5, indicating a medium severity impact primarily affecting availability.
FLTK versions up to and including 1.4.5 have a stack-based buffer overflow vulnerability in the Fl_BMP_Image::load_bmp_() function. This flaw occurs when processing BMP or ICO files with a colors_used field value exceeding 256, which overflows a 768-byte colormap array. Exploitation can lead to application crashes or potentially allow code execution.
A vulnerability was detected in a2aproject a2a-go up to 2.4.0. This affects the function CreateExecutor of the file a2asrv/agentexec.go of the component Push Notification Handler. The manipulation results in information exposure through error message. It is possible to launch the attack remotely. Upgrading to version 2.5.0 mitigates this issue. The patch is identified as f4d588216b0c9520e94d571bab725c38ce23064c. It is recommended to upgrade the affected component.
CVE-2026-116589 is a high-severity vulnerability in DataDog's Python APM client dd-trace-py affecting versions from 3.13.0 up to but not including 4.15.5. The issue arises from improper handling of certain internal errors in the IAST string-processing instrumentation when old-style % string formatting processes attacker-controlled input. This can cause an unhandled exception that terminates the Python process, disrupting application operation. Exploitation requires IAST to be enabled, which is not the default setting, and the application to apply the vulnerable formatting to attacker-controlled input. The vulnerability is fixed in version 4.15.5.
CVE-2026-116588 is a high-severity vulnerability in DataDog's Python APM client dd-trace-py affecting versions from 1.5.0 up to but not including 3.19.9 and from 4.0.0 up to but not including 4.15.6. The issue arises from an inefficient regular expression used by default for query-string obfuscation, which can cause excessive backtracking when processing attacker-controlled URL query strings. This leads to prolonged CPU consumption, increased request latency, and potential service unavailability in HTTP tracing integrations that include query strings in URL span tags. The vulnerability is fixed in versions 3.19.9 and 4.15.6.
A vulnerability in go-jose prior to version 4.1.5 allows a denial of service via improper validation of array index during decryption of certain JWE ciphertexts. Specifically, decrypting untrusted ciphertexts encrypted with A128CBC-HS256, A192CBC-HS384, or A256CBC-HS512 can result in an empty ciphertext buffer being passed to the CBC-HMAC unpadding function. This causes an out-of-bounds access that triggers a panic and crashes the application.
A vulnerability has been identified in the RDSEED instruction on AMD Zen 5 (Turin) processors. The 16- and 32-bit versions of the RDSEED instruction can silently fail under certain system load conditions, potentially compromising applications that rely on these instructions for cryptographic random number generation. The 64-bit version of RDSEED is not affected and remains safe. AMD is currently investigating this issue. The 64-bit Linux kernel uses the safe 64-bit RDSEED instruction for /dev/[u]random, so those random numbers are not impacted. Applications that synthesize random numbers using the 16- or 32-bit RDSEED instructions should be aware of this insecurity.
CVE-2026-113913 is a vulnerability in Apple iOS and iPadOS where processing web content may disclose sensitive information due to an input validation issue. The flaw affects multiple Apple operating systems and has been addressed with improved input validation. Fixed versions include iOS 26.7.2, iOS 27.2, iPadOS 26.7.2, iPadOS 27.2, and macOS versions 15.8.2 and 27.2. The vulnerability has a medium severity rating with a CVSS score of 6.5.
CVE-2026-116576 is an OS command injection vulnerability in the systeminformation Node.js library prior to version 5.33.16. The issue arises from improper sanitization of service names used in PowerShell commands on Windows, allowing an attacker to inject arbitrary PowerShell expressions. Exploitation requires local or forwarded attacker-controlled input to the vulnerable services() or getDynamicData() functions. The vulnerability is fixed in version 5.33.16.
CVE-2026-70382 is a cross-site scripting (XSS) vulnerability affecting multiple WolfVision Cynap devices. The issue arises because some externally supplied values stored by the device are rendered in the web interface without proper output encoding. An attacker who can influence these stored values may cause script execution in the browser of users who view the affected pages. Exploitation requires both the ability to influence stored values and a user viewing the vulnerable page. The vulnerability has a medium severity rating with a CVSS score of 5.1.
CVE-2026-65628 is a vulnerability in the potatosalad jose library versions 1.5.0 up to but not including 1.11.13. It involves uncontrolled recursion in the function jose_jwk:shared_secret/2 when deriving an ECDH shared secret from two JSON Web Keys (JWKs) of differing key types. An attacker can supply a crafted JWK with a mismatched key type to cause an infinite tail-recursive loop, resulting in 100% CPU usage on an Erlang scheduler and potential denial of service due to resource exhaustion.
There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. A patch is provided for impacted ArcGIS Server software in General Availability and Extended support status, which includes versions 11.5. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
A vulnerability was identified in FastStone Image Viewer up to 8.5. Affected is the function FUN_0062d96c of the component Box-Average Downsampler Engine. The manipulation leads to out-of-bounds read. It is possible to initiate the attack remotely. The vendor was contacted early about this disclosure but did not respond in any way.
There is a reflected cross site scripting vulnerability in Esri Portal for ArcGIS versions 12.1 and prior which may allow a remote, unauthenticated attacker to create a crafted link which when clicked could potentially execute arbitrary JavaScript code in the victim’s browser. A patch is provided for ArcGIS Server software in General Availability and Extended support status, which includes versions 12.1, 12.0, 11.5, 11.3, and 11.1. Other versions are in mature or retired status, which are not patch eligible. Users working with unlisted versions are advised to upgrade and apply the patch.
OpenJPEG 2.4.0 through 2.5.4, and git master through commit 8314119b, contains an out-of-bounds read and write in opj_dwt_encode_and_deinterleave_v() in src/lib/openjp2/dwt.c. This allows an attacker to cause a denial of service.