CVE-2026-92709 is a medium severity vulnerability affecting multiple specific versions of the rsyslog software package, primarily distributed in various Ubuntu releases. The exact nature and technical details of the vulnerability are not described in the available data. There is no CVSS score or detailed impact information provided. No patch or remediation guidance is currently available, and no known exploits in the wild have been reported.
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.
Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
libyang versions through 6.4.13 have a vulnerability in the lydxml_env_netconf_rpc() function where an uninitialized pointer is freed during parsing of NETCONF rpc action envelopes. This flaw allows peers with a NETCONF session to send crafted action elements containing non-whitespace text via lyd_parse_op(), potentially causing server crashes or heap corruption in applications like netopeer2.
fzf versions 0.36.0 through 0.74.5 have an inefficient algorithmic complexity vulnerability in the maskActionContents function. This flaw allows local attackers to exhaust the --listen HTTP server by sending large POST requests repeatedly, causing the single-threaded server to block for about 30 seconds each time. The vulnerability results in a denial of service condition but does not impact confidentiality or integrity.
A vulnerability in GNU patch allows an attacker to create files arbitrarily outside the intended working directory by using specially crafted patch files. This occurs due to missing validation of absolute file paths during automatic patch reversal, enabling file creation with the permissions of the executing user. The flaw affects multiple specific versions of the patch utility. No official fix or mitigation meeting Red Hat's criteria is currently available.
Red Hat has released version 3.11.3 of its OpenShift distributed tracing platform (Tempo), which upgrades Tempo to version 2.10.10 and includes security improvements. There are no breaking changes, deprecations, or bug fixes noted in this release. The advisory references CVE-2026-108859 and CVE-2026-111943 but does not detail specific vulnerabilities or fixes. No known exploits are reported in the wild. The update is classified as important and addresses security concerns.
Lotus versions up to 0.10.2 contain an authorization bypass vulnerability in the ChangeUserOrganizationView.post endpoint. Authenticated users can supply any organization's UUID to join that organization without proper authorization, potentially accessing tenant data and billing configurations of other organizations.
CVE-2026-115333 is an improper authentication vulnerability in the uselotus lotus product up to version 0.10.2. The flaw exists in the Go event ingestion middleware, which validates API keys by prefix only and does not verify the secret against the stored hashed key. This allows attackers who know or obtain an API key prefix to submit usage events as that organization, potentially altering metered usage and billing.
Lotus versions up to 0.10.2 have an SQL injection vulnerability that allows authenticated users to inject SQL via crafted subscription_filter_keys. This bypasses keyword-only validation and enables attackers to manipulate usage aggregation queries in the multi-tenant database. The vulnerability is fixed in version 0.10.3.
Lotus versions up to 0.10.2 contain an SQL injection vulnerability that allows authenticated organization users to execute arbitrary SQL commands by appending stacked statements to custom metric queries. The vulnerability arises because the application accepts semicolon-separated SQL statements via the POST /app/metrics/ endpoint and only validates the first statement, enabling bypass of input validation. This flaw can lead to unauthorized reading or modification of data across all tenants.
CVE-2026-115329 is an authorization bypass vulnerability in the uselotus lotus product up to version 0.10.2. The flaw exists in SubscriptionViewSet.get_object(), which uses an unscoped queryset lacking organization filtering or permission checks. This allows authenticated users or API keys from any organization to access and modify subscription data belonging to other organizations, including reading, canceling, updating, switching plans, or modifying addons.
Weaver E-cology versions 8.0, 9.0, and 10.0 prior to 10.76 contain an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can exploit this flaw by injecting SQL through the doc_datefrom and doc_dateto fields and retrieve database information via the /api/ec/dev/table/counts endpoint. The vulnerability was first observed exploited in the wild by the Shadowserver Foundation on 2026-07-19. A fix is available in version 10.76.
Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute scripts by proxying malicious SVG files through /api/imageProxy. Attackers can supply an attacker-hosted SVG in the url parameter, which is served from the Retool origin without a Content Security Policy, executing JavaScript in victims' sessions. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-10-15.
A vulnerability in webpack-dev-server versions from 5.1.0 before 5.2.7 and version 6.0.0 allows unauthenticated attackers to trigger an exception via a specially crafted Host header to the open-editor endpoint. This causes the server to return an HTTP 500 error with a full exception stack trace that discloses sensitive information such as absolute filesystem paths and internal source line numbers. The server remains operational after the error. The issue is fixed in versions 5.2.7 and 6.1.0.
In webpack-dev-server versions before 5.2.7 and version 6.0.0, a vulnerability exists in the proxy WebSocket forwarding feature. The server forwards non-HMR WebSocket upgrade requests to the proxy target without validating Host or Origin headers, bypassing allowedHosts protections. This allows a malicious web page visited by a developer to open a cross-origin WebSocket through the dev server and interact with the proxied backend, even if the server is bound to loopback. The issue is fixed in versions 5.2.7 and 6.1.0.
A low-severity vulnerability (CVE-2026-114459) was found in mod_qos versions 11.76-4, 11.76-5, 11.76-6, 11.77-1, 11.78-1, 11.79-1, and 11.79-1build1. The flaw relates to inspecting HTTP response bodies and results in a low impact on availability. No known exploits are reported in the wild.
A vulnerability in mod_qos allows an unauthenticated remote attacker to cause a denial of service. The flaw affects specific versions of mod_qos and has a medium severity rating with a CVSS score of 5.9. There is no indication of confidentiality or integrity impact, only availability is affected. No known exploits are reported in the wild, and no patch or remediation details are provided in the available data.
A vulnerability exists in mod_qos versions 11.76-4 through 11.79-1build1 that allows an unauthenticated remote attacker to cause a denial of service. The flaw does not impact confidentiality or integrity but can affect availability. The CVSS score is low (3.7) reflecting the limited impact and the requirement for high attack complexity.
CVE-2026-114177 is a Cross-Site Request Forgery (CSRF) vulnerability in Xpro Elementor Addons affecting versions from initial release up to 1.7.10. This flaw allows attackers to perform unauthorized actions on behalf of authenticated users. The vulnerability has a high severity with a CVSS score of 8.8. A fix is available in version 1.7.11.