Telepresence versions prior to 2.31.0 contain a vulnerability in the Traffic Manager gRPC API that allows unauthenticated callers within the cluster network to register in any managed namespace and create service intercepts without proper Kubernetes RBAC checks. This flaw enables an attacker with network access to the manager pod to intercept traffic and access sensitive container environment data, including secrets and tokens. The issue is fixed in version 2.31.0.
CVE-2026-122224 is a missing authorization vulnerability in the WebVirtCloud project by retspen. Due to the absence of declared permission classes in certain API views, low-privileged authenticated users can access sensitive endpoints that should be restricted. This allows them to migrate or undefine other users' virtual machines and create volumes and domains on any compute host.
Trawl versions from 1.5.0 up to but not including 1.10.0 contain a server-side request forgery (SSRF) vulnerability. This flaw allows unauthenticated attackers to bypass the outbound URL policy by using IPv4-mapped IPv6 addresses, enabling them to access internal resources such as loopback, private networks, and cloud metadata services. The vulnerability is fixed in version 1.10.0.
blueprintUE Self-Hosted Edition versions before 4.3.3 have an account enumeration vulnerability in the ForgotPasswordMiddleware.php component. This flaw allows unauthenticated attackers to determine whether an email address is registered by observing differences in password reset redirect behavior. The vulnerability is exacerbated by the lack of rate limiting on failed lookup attempts, enabling unlimited enumeration.
BlueprintUE Self-Hosted Edition versions 4.2.0 up to but not including 4.3.4 have a vulnerability in their login rate limiting mechanism. The issue arises because failed-login counters are keyed on case-sensitive usernames, while the underlying MySQL database performs case-insensitive lookups. This discrepancy allows unauthenticated attackers to bypass per-account lockout by varying the casing of usernames, enabling additional brute-force attempts on passwords.
Powerlevel10k versions before 1.20.19 contain a vulnerability in the bundled gitstatus/install script where an insecure temporary directory is reused if mktemp fails. This allows local attackers to pre-create a predictable temporary directory named gitstatus-install.tmp and replace the extracted gitstatusd binary, which then executes with the victim's privileges.
Powerlevel10k versions before 1.20.19 have a symlink following vulnerability in the _p9k_dump_instant_prompt function. This flaw allows local attackers to overwrite files writable by the victim by pre-planting symbolic links in a predictable temporary file path based on the victim's shell PID. The vulnerability is fixed in version 1.20.19.
Mistral Vibe versions prior to 3.0.3 contain a remote code execution vulnerability. This flaw allows attackers to execute arbitrary commands by manipulating repository settings related to gpg.program and log.showSignature. Exploitation occurs during project context collection when a crafted repository with a signed commit triggers git log to run the attacker's program at session start, before any trust prompt is shown. The vulnerability is fixed in version 3.0.3.
Mistral Vibe versions before 2.25.7 contain a remote code execution vulnerability. This flaw allows attackers to execute arbitrary commands by configuring malicious Git clean or process filter drivers in a repository. When a user opens such a crafted repository, the application runs 'git status' at startup, triggering the malicious filters and executing commands with the user's privileges before any trust prompt appears. This vulnerability is fixed in version 2.25.7.
Mistral Vibe versions before 2.25.5 on Windows have an untrusted search path vulnerability. This flaw allows attackers to execute arbitrary code by placing a malicious git.exe in a repository root. When a user opens a crafted repository, components SessionLogger and ProjectContextProvider run the malicious git.exe at session start without any trust prompt.
CVE-2026-122132 is an open redirect vulnerability in the go-chi chi web framework versions 5.2.2 through 5.5.0. The flaw exists in the RedirectSlashes middleware, where attackers can embed URL-encoded tab characters in request paths. Browsers strip these tabs from the 301 Location header, causing the redirect to resolve as a protocol-relative URL and allowing redirection to external, potentially untrusted hosts. This bypasses a previous fix for CVE-2025-69725.
CVE-2026-122131 is a prototype pollution vulnerability in the hapijs joi library affecting versions >=17.13.6 <17.13.9 and >=18.2.5 <18.3.1. The flaw exists in lib/messages.js within the compile() and merge() functions, which fail to reject a __proto__ language key. This allows attackers to modify the prototype of compiled messages, potentially altering or breaking validation error rendering and related logic. The issue is fixed in versions 17.13.9 and 18.3.1.
CESNET ipfixcol2 versions 2.3.0 up to but not including 2.9.0 contain an integer overflow vulnerability in the Forwarder output plugin. This flaw allows unauthenticated IPFIX exporters to overflow a heap buffer by wrapping uint16_t message length counters. Attackers can exploit this by sending near-65535-byte data sets and large templates to a collector forwarding over TCP, potentially causing a crash and enabling 2-byte writes to attacker-controlled memory addresses. The vulnerability is fixed in version 2.9.0.
CESNET ipfixcol2 versions 2.7.1 up to but not including 2.9.0 contain a memory allocation vulnerability in the Lz4Decoder::read_start_header() function. This flaw allows unauthenticated attackers to cause excessive memory allocation by sending LZ4 start headers with very large buffer sizes, potentially exhausting up to 4 GiB of memory per TCP connection. The issue can lead to denial of service by exhausting collector service resources. The vulnerability is fixed in version 2.9.0.
CESNET ipfixcol2 versions 2.7.1 up to but not including 2.9.0 contain a heap-based buffer overflow vulnerability in the Lz4Decoder.cpp component. This flaw allows unauthenticated network peers to write beyond allocated heap buffers by manipulating buffer size parameters, potentially crashing the collector or causing other memory corruption issues. The vulnerability is fixed in version 2.9.0.
A heap-based buffer overflow vulnerability exists in reSIProcate reTurn client versions up to 1.14.0 in the TurnTcpSocket::handleReadHeader() function. Malicious TURN servers can exploit this by sending STUN or ChannelData frames with oversized declared lengths, causing memory overwrite beyond the allocated buffer and crashing the client.
CVE-2026-121969 is a stack-based buffer overflow vulnerability in netrek-client-cow versions up to 3.3.3. The flaw exists in the handleSMessage() function in short.c, where oversized SP_S_MESSAGE packets can overflow a 100-byte stack buffer. This vulnerability allows a malicious Netrek server or a man-in-the-middle attacker on the plaintext TCP connection to send specially crafted messages that overwrite stack memory, potentially crashing the client.
Netrek-client-cow versions up to 3.3.3 have an out-of-bounds read vulnerability in the short.c handleSMessage() function. This flaw allows malicious Netrek servers or attackers intercepting the TCP connection to send crafted SP_S_MESSAGE packets with an unchecked m_recpt index of 36 or higher. Exploitation can cause the client to read beyond array bounds, leading to a denial of service via client crash.
vtenext versions 25.02 prior to 25.02.1 contain a critical authentication bypass vulnerability. This flaw allows unauthenticated attackers to change any account password without token verification by exploiting the hub/rpwd.php endpoint. Attackers who know a valid username can send a password change request and gain administrator access if two-factor authentication is not enabled. The vulnerability is fixed in version 25.02.1.
vtenext versions prior to 25.02.2 contain an SQL injection vulnerability in the modules/Fax/EditView.php component. Authenticated users with low privileges can exploit this flaw by supplying a crafted fieldname parameter, enabling them to read arbitrary database contents, including sensitive password reset tokens. This could lead to account takeover of other users. The vulnerability is rated high severity with a CVSS score of 8.6. A fix is available in version 25.02.2.