Dify is an open-source LLM app development platform. Prior to 1.13.0, a cross site scripting vulnerability has been found in the web application chat frontend when using echarts. User or llm inputs containing echarts containing a specific javascript payload will be executed. This vulnerability is fixed in 1.13.0.
WSL or “Windows Subsystem Linux”[1] is a feature in the Microsoft Windows ecosystem that allows users to run a real Linux environment directly inside Windows without needing a traditional virtual machine or dual boot setup. The latest version, WSL2, runs a lightweight virtualized Linux kernel for better compatibility and performance, making it especially useful for development, DevOps, and cybersecurity workflows where Linux tooling is essential but Windows remains the primary operating system. It was introduced a few years ago (2016) as part of Windows 10.
DNG SDK versions 1.7.1 2410 and earlier are affected by an out-of-bounds write vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
DNG SDK versions 1.7.1 2410 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could lead to application denial-of-service. An attacker could exploit this vulnerability to cause the application to crash or become unresponsive. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
DNG SDK versions 1.7.1 2410 and earlier are affected by an Integer Overflow or Wraparound vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
DNG SDK versions 1.7.1 2410 and earlier are affected by an out-of-bounds read vulnerability that could lead to memory exposure. An attacker could leverage this vulnerability to disclose sensitive information stored in memory. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Emmett is a framework designed to simplify your development process. Prior to 1.3.11, the cookies property in mmett_core.http.wrappers.Request does not handle CookieError exceptions when parsing malformed Cookie headers. This allows unauthenticated attackers to trigger HTTP 500 errors and cause denial of service. This vulnerability is fixed in 1.3.11.
CVE-2026-25846 is a medium severity vulnerability in JetBrains YouTrack prior to version 2025.3.119033 where access tokens could be exposed in mailbox logs. This exposure stems from improper handling of sensitive information (CWE-532), potentially allowing attackers with network access and low privileges to obtain tokens without user interaction. While the vulnerability does not impact integrity or availability, the confidentiality breach could enable unauthorized access to YouTrack resources. No known exploits are currently reported in the wild. European organizations using affected YouTrack versions should prioritize updating to the patched release to prevent token leakage. Mitigation involves upgrading YouTrack, auditing mailbox logs for token exposure, and restricting log access. Countries with significant JetBrains YouTrack adoption, such as Germany, France, and the UK, are most likely to be impacted due to their large software development sectors. The vulnerability’s CVSS score of 6.
CVE-2026-25905 is a medium severity vulnerability affecting the 'mcp-run-python' project, where Python code executed via 'runPython' or 'runPythonAsync' is not properly isolated from JavaScript code. This improper compartmentalization (CWE-653) allows Python code to manipulate the JavaScript environment through Pyodide APIs, potentially enabling an attacker to hijack the MCP server and perform malicious activities such as tool shadowing. The vulnerability has a CVSS score of 5.8, indicating moderate risk, with network attack vector, high attack complexity, no privileges required, and user interaction needed. The project is archived and unlikely to receive patches, increasing the risk for users still relying on it. There are no known exploits in the wild as of now. European organizations using this tool or similar environments integrating Python and JavaScript without proper isolation are at risk, especially those in critical infrastructure or software development sectors. Mitigation requires isolating Python execution environments, restricting Pyodide API access, or migrating away from the unmaintained project. Countries with strong software development ecosystems and critical infrastructure relying on such tools, including Germany, France, the UK, and the Netherlands, are more likely to be affected.
CVE-2026-25904 is a Server-Side Request Forgery (SSRF) vulnerability in the Pydantic-AI MCP Run Python tool, which uses an overly permissive Deno sandbox configuration. This misconfiguration allows Python code executed within the sandbox to access the localhost interface of the host system, potentially enabling SSRF attacks. The project is archived and unlikely to receive a fix, increasing risk for users who continue to rely on it. The vulnerability has a CVSS score of 5.8 (medium severity), reflecting moderate impact and exploitation complexity. Exploitation requires user interaction but no privileges or authentication. While no known exploits are currently in the wild, the vulnerability could allow attackers to access internal services, leading to information disclosure and limited integrity and availability impacts. European organizations using this tool or similar configurations should be cautious, especially those in countries with strong adoption of Python and Deno-based development environments. Mitigation involves discontinuing use of the vulnerable tool, isolating sandbox environments, and restricting network access from sandboxed code. Countries with significant tech sectors and software development communities, such as Germany, France, the UK, and the Netherlands, are most likely to be affected.
CVE-2026-25546 is a high-severity OS command injection vulnerability in godot-mcp versions prior to 0.1.1. The vulnerability arises because user-controlled input, such as projectPath, is passed unsanitized to a shell execution function, allowing attackers to inject arbitrary shell commands. Exploitation requires local access with limited privileges and some user interaction but can lead to full compromise of the MCP server process. This affects any functionality accepting projectPath, including create_scene, add_node, and load_sprite commands. The vulnerability has been patched in version 0.1.1, and no known exploits are currently reported in the wild. European organizations using godot-mcp in development or production environments should update immediately and restrict access to the MCP server.
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6, an out-of-bounds read vulnerability was reported in the BLE ATT Prepare Write handling of the BLE provisioning transport (protocomm_ble). The issue can be triggered by a remote BLE client while the device is in provisioning mode. The transport accumulated prepared-write fragments in a fixed-size buffer but incorrectly tracked the cumulative length. By sending repeated prepare write requests with overlapping offsets, a remote client could cause the reported length to exceed the allocated buffer size. This inflated length was then passed to provisioning handlers during execute-write processing, resulting in an out-of-bounds read and potential memory corruption. This issue has been patched in versions 5.5.3, 5.4.4, 5.3.5, 5.2.7, and 5.1.7.
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6, a use-after-free vulnerability was reported in the BLE provisioning transport (protocomm_ble) layer. The issue can be triggered by a remote BLE client while the device is in provisioning mode. The vulnerability occurred when provisioning was stopped with keep_ble_on = true. In this configuration, internal protocomm_ble state and GATT metadata were freed while the BLE stack and GATT services remained active. Subsequent BLE read or write callbacks dereferenced freed memory, allowing a connected or newly connected client to trigger invalid memory acces. This issue has been patched in versions 5.5.3, 5.4.4, 5.3.5, 5.2.7, and 5.1.7.
ESF-IDF is the Espressif Internet of Things (IOT) Development Framework. In versions 5.5.2, 5.4.3, 5.3.4, 5.2.6, and 5.1.6, a vulnerability exists in the WPS (Wi-Fi Protected Setup) Enrollee implementation where malformed EAP-WSC packets with truncated payloads can cause integer underflow during fragment length calculation. When processing EAP-Expanded (WSC) messages, the code computes frag_len by subtracting header sizes from the total packet length. If an attacker sends a packet where the EAP Length field covers only the header and flags but omits the expected payload (such as the 2-byte Message Length field when WPS_MSG_FLAG_LEN is set), frag_len becomes negative. This negative value is then implicitly cast to size_t when passed to wpabuf_put_data(), resulting in a very large unsigned value. This issue has been patched in versions 5.5.3, 5.4.4, 5.3.5, 5.2.7, and 5.1.7.
CVE-2026-25155 is a medium severity Cross-Site Request Forgery (CSRF) vulnerability in the Qwik JavaScript framework versions prior to 1.12.0. The flaw stems from a typo in the regular expression used by the isContentType function, causing improper parsing of certain Content-Type headers. This parsing error can be exploited by attackers to craft malicious requests that bypass normal CSRF protections, potentially leading to unauthorized actions with high integrity impact but low confidentiality and no availability impact. The vulnerability requires user interaction and remote network access but no authentication. Although no known exploits are reported in the wild, organizations using vulnerable Qwik versions should upgrade to 1.12.0 or later. European organizations that heavily rely on Qwik for web applications, especially in countries with significant software development ecosystems, are at risk.
CVE-2026-25233 is a high-severity logic vulnerability in the PEAR pearweb system affecting versions prior to 1.33.0. The flaw is an operator precedence logic error in the roadmap role check, which allows non-lead maintainers to create, update, or delete roadmaps without proper authorization. This vulnerability does not require user interaction or elevated privileges beyond maintainer access and can be exploited remotely over the network. Although no known exploits are currently in the wild, the issue impacts the integrity of project management data within pearweb. The vulnerability has been patched in version 1.33.0, and organizations using affected versions should upgrade promptly. European organizations relying on PEAR components for PHP development or project management are at risk, especially those with active development teams using pearweb.
CVE-2025-65875 is a high-severity arbitrary file upload vulnerability in the AddFont() function of FPDF version 1.86 and earlier. It allows attackers with low privileges to upload crafted PHP files without user interaction, leading to remote code execution. The vulnerability impacts confidentiality, integrity, and availability of affected systems and can be exploited remotely over the network. No known exploits are currently in the wild, and no patches have been published yet. European organizations using vulnerable FPDF versions in web applications are at risk, especially those in sectors relying heavily on PDF generation. Mitigation involves restricting file upload capabilities, implementing strict input validation, and monitoring for suspicious file uploads. Countries with significant software development and digital services sectors, such as Germany, France, and the UK, are more likely to be affected. Due to the high impact and ease of exploitation, this vulnerability demands urgent attention from defenders.
The NixOs Odoo package is an open source ERP and CRM system. From 21.11 to before 25.11 and 26.05, every NixOS based Odoo setup publicly exposes the database manager without any authentication. This allows unauthorized actors to delete and download the entire database, including Odoos file store. Unauthorized access is evident from http requests. If kept, searching access logs and/or Odoos log for requests to /web/database can give indicators, if this has been actively exploited. The database manager is a featured intended for development and not meant to be publicly reachable. On other setups, a master password acts as 2nd line of defence. However, due to the nature of NixOS, Odoo is not able to modify its own configuration file and thus unable to persist the auto-generated password. This also applies when manually setting a master password in the web-UI. This means, the password is lost when restarting Odoo. When no password is set, the user is prompted to set one directly via the database manager. This requires no authentication or action by any authorized user or the system administrator. Thus, the database is effectively world readable by anyone able to reach Odoo. This vulnerability is fixed in 25.11 and 26.05.
CVE-2026-22780 is a medium severity heap overflow vulnerability in rizin versions prior to 0.8.2. It occurs when rizin parses a malicious Mach-O file containing bogus entries in the dyld chained segments, leading to allocation of resources without proper limits or throttling. Exploitation requires local access and user interaction, with no privileges needed, and can result in partial integrity and availability impacts. The vulnerability has not been observed exploited in the wild and was fixed in version 0.8.2. European organizations using rizin for reverse engineering or malware analysis should update promptly to mitigate risks. The threat primarily affects UNIX-like environments where rizin is deployed, with higher relevance in countries with strong cybersecurity research and software development sectors.
CVE-2026-24007 is a medium-severity Cross-Site Request Forgery (CSRF) vulnerability affecting Enalean's Tuleap software versions prior to 17.0.99.1768924735. The flaw exists in the 'Overview inconsistent items' functionality, where missing CSRF protections allow attackers to trick authenticated users into performing unintended actions, specifically repairing inconsistent items by creating artifact links from releases. Exploitation requires the victim to be authenticated and interact with a maliciously crafted request. The vulnerability impacts the integrity and availability of the affected system but does not compromise confidentiality. Fixed versions have been released in both the Community and Enterprise Editions. European organizations using vulnerable Tuleap versions for software development management should prioritize patching to prevent potential misuse. No known exploits are reported in the wild as of now.
