djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's observability endpoints expose live view/session state and a remote method-invocation surface (`eval_handler`). The localhost restriction was an opt-in middleware that the documented setup omits; the views themselves enforced only `DEBUG`. In the misconfigured-but-documented scenario (DEBUG on, middleware not installed) a non-localhost client could read live application state and invoke handlers remotely. This issue is fixed in djust 1.0.7. The localhost restriction is enforced in-view on every observability endpoint (no longer dependent on a separately-installed middleware), and `eval_handler` is restricted; gated requests receive a non-disclosing response. As a workaround, ensure `DEBUG=False` in production, and do not expose the observability endpoints to untrusted networks.
CVE-2026-47844 is a medium severity vulnerability in Spring's Reactor Netty HTTP Server where exception details may be leaked across unrelated requests when the server is configured with Brave Tracing. This affects certain versions of Reactor Netty including 1.3.0 to 1.3.6, 1.1.0 to 1.2.18, and 1.0.52 and earlier. The vulnerability is classified under CWE-668, which involves exposure of resources to the wrong sphere. No official patch or remediation guidance has been provided yet.
Flytohub flyto-core versions prior to 2.26.6 contain a vulnerability where the workflow engine variable resolver expands environment variables without an allowlist or capability policy check. This allows workflow parameters to bypass default denylist policies and potentially exfiltrate secrets through allowed modules. The issue is fixed in version 2.26.6.
proot-distro is a utility for managing proot containers. Prior to version 5.1.6, proot-distro restore accepted hardlink entries whose linkname referenced another installed container and did not verify that the hardlink source container matched the destination container being restored, allowing a crafted restore archive to copy files between otherwise isolated containers. This issue is fixed in version 5.1.6.
A race condition vulnerability exists in the view_component Ruby on Rails framework versions 4.0.0 up to but not including 4.12.0. The issue arises because ViewComponent::Base instances retain render-scoped objects across calls to render_in, causing stale context to be reused across requests or threads. This can lead to unauthorized UI rendering, leaking of request context, and mixing of state between users. The vulnerability is fixed in version 4.12.0.
Pegatron `Tdelo64.sys` improperly exposes privileged hardware access functionality through the `\\.\TdeIo` device interface. IOCTL handlers including `TDE_IOCTL_INDEXIO_READ` and `TDE_IOCTL_INDEXIO_WRITE` permit unprivileged user-mode callers to perform arbitrary hardware I/O port reads and writes without authorization checks. A local attacker can abuse this functionality to manipulate hardware registers, tamper with firmware-related interfaces, cause system instability, or establish persistent low-level compromise.
A exposure of resource to wrong sphere vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.2, FortiSandbox 4.4.3 through 4.4.8 may allow an unauthenticated attacker to access the VNC server of VMs performing scanning via network requests.
CVE-2026-53657 is a vulnerability in lima-vm's lima product versions prior to 2.1.3. When running with the qemu driver and the guest agent enabled, an arbitrary user inside the VM can access the guest agent socket (/run/lima-guestagent.sock), potentially allowing execution of arbitrary commands with root privileges inside the VM. This issue does not affect the vz driver, which uses vsocks instead of Unix sockets. The vulnerability is patched in version 2.1.3. The default user in the VM can already run commands as root via sudo, so this behavior is not considered a vulnerability by design. Workarounds include using the vz driver or disabling the guest agent.
Podman is a tool for managing OCI containers and pods. From 1.8.1 until 5.8.4, a container image that contains a environment variable with just a key and no value can trick podman into passing that variable from the host into the container. This is made worse by the fact that using an asterisk (*) will cause podman to pass all host variables into the container. So essentially a malicious image can exfiltrate all podman environment variables that are set in the session from where the container is launched. This vulnerability is fixed in 5.8.4 and 6.0.0.
A vulnerability in Steeltoe.Security.Authentication.CloudFoundryBase and related Steeltoe authentication libraries prior to certain versions allows improper caching of JWT signing keys. The cache uses the 'kid' value without namespacing by authority, causing keys from one identity provider to be incorrectly trusted for another in multi-scheme applications. Cached keys also do not expire, so revoked or rotated keys remain trusted until the application restarts. Fixed versions address this issue by properly namespacing and managing cache expiration.
vm2 is an open source vm/sandbox for Node.js. Prior to version 3.11.4, NodeVM exposes some process-wide observability builtins when they are allowed through require.builtin. The diagnostics_channel, async_hooks, and perf_hooks builtins are not blocked by the dangerous builtin denylist. These modules are process-wide, not sandbox-local. Sandboxed code can use them to observe host application data across the vm2 boundary. This issue has been patched in version 3.11.4.
A path handling vulnerability exists in the mod_dav_fs module of Apache HTTP Server versions 2.4.67 and earlier. This flaw allows a WebDAV content author to manipulate trusted DAV property databases, which can lead to child process crashes. The issue is resolved in version 2.4.68, and users should upgrade to this version to mitigate the risk.
Dräger Zeus Infinity Empowered (Zeus IE) and Zeus RS C500 anesthesia workstations contain a local security vulnerability that allows unauthorized individuals with physical access to compromise software integrity via USB interface manipulation. Attackers can exploit the unprotected USB interfaces to impair therapy functions, manipulate device-processed data, or leverage the device as a pivot point for broader network-based attacks when connected to a network or Dräger Service Connect.
Algernon is a small self-contained pure-Go web server. Prior to 1.17.7, the SSE event server bound to 0.0.0.0:5553 on Linux/macOS by default because the platform-dependent host default in engine/flags.go:39-46 set host = "" for non-Windows, and utils.JoinHostPort("", ":5553") resolves to ":5553". This vulnerability is fixed in 1.17.7.
Information disclosure, sandbox escape in the Security: Process Sandboxing component. This vulnerability was fixed in Firefox 151, Firefox ESR 140.11, Thunderbird 151, and Thunderbird 140.11.
CVE-2026-46723 is a medium severity vulnerability in the TYPO3 Extension "Faceted Search". It involves the additional_tables configuration of the page and tt_content indexers, which accepts arbitrary table and field names. This allows a backend user with permission to edit indexer configurations to copy sensitive data from internal TYPO3 tables into the search index, potentially exposing data to unauthorized spheres.
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.3, it is possible to catch a host exception using the yield* expression inside an async generator. When the generator is closed using the return function, the value is awaited on and exceptions thrown in the then call will be caught by the runtime and passed to the yield* iterator as the next value. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This vulnerability is fixed in 3.11.3.
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, VM2 suffers from a sandbox breakout vulnerability. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This vulnerability is fixed in 3.11.2.
vm2 is an open source vm/sandbox for Node.js. Prior to 3.11.2, the new method neutralizeArraySpeciesBatch works with objects from the other side but can call into this side via getter on the array prototype exposing objects of the wrong side into the sandbox. This can be used to get host objects and get the host Function object. This allows attackers to write code which can escape from the VM2 sandbox and execute arbitrary commands on the host system. This vulnerability is fixed in 3.11.2.
A vulnerability in Wikimedia Foundation's MediaWiki affects versions before 1.43.7, 1.44.4, and 1.45.2. The issue involves the action=raw parameter with the Special:Mypage subpage title responding with an incorrect Content-Type header of "text/html". This vulnerability is linked to the program files includes/Actions/ActionEntryPoint.Php and includes/Request/FauxResponse.Php.