CVE-2026-55376 is a high-severity OS command injection vulnerability in heymrun's heym product prior to version 0.0.40. Authenticated users with permissions to create or edit workflows using an Agent custom Python tool can bypass sandbox restrictions due to improper validation of imported standard-library modules. This allows execution of arbitrary OS commands and file operations with the backend application user's privileges. The issue is fixed in version 0.0.40.
CVE-2026-84319 is a vulnerability in 0xJacky's nginx-ui that allows a secondary authenticated user to bypass restricted directive validation in the MCP configuration interface. While the HTTP API blocks restricted Nginx directives such as load_module, js_import, and js_content, the MCP interface permits writing and applying equivalent restricted configurations. This enables execution of attacker-controlled NJS scripts within the Nginx worker context, potentially modifying runtime behavior including responses and routing. The vulnerability affects versions prior to 2.4.1. The CVSS score is 8.3 (high severity).
CVE-2026-84317 is an improper input validation vulnerability in the 0xJacky nginx-ui product. The vulnerability arises because the MCP tool 'nginx_config_add' does not enforce validation on user-supplied nginx configuration content, unlike other config-write paths. This allows an authenticated user to inject dangerous nginx directives such as 'js_*', 'perl_*', 'load_module', and 'user root', potentially leading to nginx code execution with root privileges if the njs/perl modules are available. The issue is due to an incomplete hardening patch that missed adding validation to the 'nginx_config_add' path. A proof of concept demonstrates remote code execution via JavaScript in the nginx worker running as root. The vulnerability affects versions prior to 2.4.1 and has a CVSS 3.1 score of 8.8 (high severity).
CVE-2026-84318 is a vulnerability in 0xJacky's nginx-ui where the MCP tool 'nginx_config_add' writes nginx configuration files without validating them, unlike the REST API which blocks dangerous directives. This allows an authenticated attacker to bypass security checks and write config files with blocked directives such as 'perl' or 'user root', leading to remote code execution on servers with certain nginx modules loaded. The vulnerability affects versions from 2.0.0-rc.6 up to but not including 2.4.1.
A protection mechanism failure exists in Coraza WAF versions 3.4.0 through 3.7.x in the multipart processor. The processor treats io.ErrUnexpectedEOF as nonfatal without setting the MULTIPART_STRICT_ERROR flag, allowing truncated multipart bodies to bypass certain defensive rules. This can lead to multipart parser-disagreement payloads reaching backend systems that interpret the truncated body differently. The issue is fixed in version 3.8.0.
A vulnerability in OWASP Coraza WAF versions 3.0.0 through 3.7.x allows attackers to bypass WAF rules due to an encoding error in the t:jsDecode transformation. This flaw causes JavaScript octal escape sequences to be improperly decoded, resulting in null byte output that corrupts rule inspection. The issue is fixed in version 3.8.0.
Coraza WAF versions from 3.0.0 up to but not including 3.8.1 have a protection mechanism failure where arguments exceeding the SecArgumentsLimit are silently dropped in some internal processing, while others do not enforce this limit. This allows unauthenticated attackers to bypass WAF rules by flooding requests with excessive arguments, causing some arguments to be omitted before inspection. Additionally, processing of urlencoded and JSON bodies can consume excessive memory, potentially degrading service. The issue is fixed in version 3.8.1.
AsyncHttpClient versions from 2.1.0 up to 2.16.1 and 3.0.0 up to but not including 3.0.14 have a session fixation vulnerability in the default ThreadSafeCookieStore. This flaw allows Secure cookies received over plaintext to be accepted and insecure cookies to overwrite or delete existing Secure cookies, enabling an attacker to manipulate cookie state sent to HTTPS origins. The issue is fixed in version 3.0.14.
CVE-2026-105668 is a Protection Mechanism Failure vulnerability in hexpm hex versions 2.5.0 up to but not including 2.5.2. It allows a package owner or an attacker who has compromised the owner's account to bypass the release-age cooldown mechanism, enabling a newly published release to be selected during dependency resolution despite being younger than the configured cooldown period. This bypass occurs because the cooldown bypass check is based solely on package name, affecting packages with the same name across repositories. The vulnerability does not affect cooldowns configured through organization dependency policies.
CVE-2026-16916 is a critical vulnerability in IBM Security Verify Access versions 10.0 through 10.0.9.2 and IBM Verify Identity Access versions 11.0 through 11.0.3. It involves a protection mechanism failure that could allow a remote authenticated attacker to execute arbitrary code. The vulnerability has a high CVSS score of 9.1, indicating severe impact on confidentiality, integrity, and availability. No patch or vendor advisory information is provided regarding remediation status.
IBM Langflow OSS versions 1.0.0 through 1.12.2 contain a vulnerability classified as CWE-693 (Protection Mechanism Failure) that allows a remote authenticated attacker to execute arbitrary code due to improper input validation. This vulnerability has a high severity with a CVSS score of 8.8. No patch or remediation information is provided in the available data.
IBM Langflow OSS versions 1.0.0 through 1.12.2 contain a vulnerability due to improper input validation that could allow a remote authenticated attacker to execute arbitrary code. This issue is classified under CWE-693, indicating a protection mechanism failure. The vulnerability has a high severity with a CVSS score of 8.8, reflecting significant potential impact on confidentiality, integrity, and availability.
CVE-2026-106439 is a high-severity vulnerability in hydra-ecosystem's hydra affecting versions 1.3.4 through 1.3.6 and 1.4.0.dev4 through 1.4.0.dev9. It involves unsafe reflection where mutable module-level state used for target blocklists can be manipulated via configuration to remove blocked targets and instantiate them, bypassing intended execution restrictions. The vulnerability affects the legacy/default path without an execution whitelist and allows a configuration controlling multiple sibling _target_ entries to mutate the blocklist and invoke otherwise blocked targets. The issue is fixed in hydra-core 1.3.7 and 1.4.0.dev10. Users are advised to upgrade and avoid passing untrusted configuration to instantiate().
Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.83.0 until 2.131.0, the KServeV2OcrModel class defined in docling/models/stages/ocr/kserve_v2_ocr_model.py sends page images to its configured endpoint without checking the pipeline_options.enable_remote_services setting, even when the caller sets that policy control to false. The StandardPdfPipeline._make_ocr_model method also fails to pass the flag into the OCR factory, allowing remote OCR processing in configurations that rely on remote services being disabled. The destination is configured by the caller rather than selected by an attacker. This issue is fixed in 2.131.0.
Podman versions from 4.4.0 up to but not including 5.8.8, and from 6.0.0 up to but not including 6.1.3, contain a vulnerability where podman run treats images with the io.podman.annotations.checkpoint.runtime.name annotation as checkpoints. This causes podman to ignore user-supplied container creation restrictions such as --cap-drop=ALL, potentially allowing weaker sandbox settings and capabilities. Rootless containers are not affected. The issue is fixed in versions 5.8.8 and 6.1.3.
Contrast, Edgeless Systems' runtime for confidential containers on Kubernetes, is affected in versions up to and including 1.9.0. The VOLUME directive in a Dockerfile (config.volumes in the OCI image configuration) is only a hint and is not handled specially by Kubernetes, but containerd adds a mount point for it when Kubernetes sets none, requiring the runtime to be able to push arbitrary data to the Kata agent. As a result, on bare-metal Contrast deployments (AKS deployments are not affected) that run an image declaring at least one VOLUME for which no Kubernetes mount exists at that path, the untrusted host can write arbitrary file trees below that mount point inside the confidential container, compromising the integrity of a directory that is typically important to the application's core functionality. Version 1.9.1 fixes the issue by disallowing this configuration in `contrast generate`.
The Paid Membership Subscriptions WordPress plugin before 3.1.0 does not verify the reCAPTCHA on its registration handler when a form field is absent from the request, allowing unauthenticated users to create accounts without solving the reCAPTCHA the site has enabled.
A vulnerability in Apache Sling Security Bundle: ContentDispositionFilter mediates only one address/API shape of a resource
This issue affects Apache Sling Security Bundle: before 1.3.12.
Users are recommended to upgrade to version 1.3.12, which fixes the issue.
The interface of Foxit PDF Editor/Reader lacks the permission verification for secure reading mode, which allows specially crafted PDFs to trigger external SMB authentication without any security prompts and thereby leak the hash of the user's credentials.
CVE-2026-79919 is a protection mechanism failure vulnerability in MaxKB, an open-source AI assistant for enterprise. Versions prior to 2.10.6-lts allow an authenticated workspace member to bypass the LD_PRELOAD sandbox syscall blacklist by exploiting a flaw in how ctypes.CDLL is invoked from a MetaPathFinder callback. This enables unauthorized read/write file access, process execution, and network access as the sandbox user. The issue is fixed in version 2.10.6-lts.