Mistral Vibe versions prior to 3.0.3 contain a remote code execution vulnerability. This flaw allows attackers to execute arbitrary commands by manipulating repository settings related to gpg.program and log.showSignature. Exploitation occurs during project context collection when a crafted repository with a signed commit triggers git log to run the attacker's program at session start, before any trust prompt is shown. The vulnerability is fixed in version 3.0.3.
Mistral Vibe versions before 2.25.7 contain a remote code execution vulnerability. This flaw allows attackers to execute arbitrary commands by configuring malicious Git clean or process filter drivers in a repository. When a user opens such a crafted repository, the application runs 'git status' at startup, triggering the malicious filters and executing commands with the user's privileges before any trust prompt appears. This vulnerability is fixed in version 2.25.7.
Mistral Vibe versions before 2.25.5 on Windows have an untrusted search path vulnerability. This flaw allows attackers to execute arbitrary code by placing a malicious git.exe in a repository root. When a user opens a crafted repository, components SessionLogger and ProjectContextProvider run the malicious git.exe at session start without any trust prompt.
CVE-2026-122132 is an open redirect vulnerability in the go-chi chi web framework versions 5.2.2 through 5.5.0. The flaw exists in the RedirectSlashes middleware, where attackers can embed URL-encoded tab characters in request paths. Browsers strip these tabs from the 301 Location header, causing the redirect to resolve as a protocol-relative URL and allowing redirection to external, potentially untrusted hosts. This bypasses a previous fix for CVE-2025-69725.
CVE-2026-122131 is a prototype pollution vulnerability in the hapijs joi library affecting versions >=17.13.6 <17.13.9 and >=18.2.5 <18.3.1. The flaw exists in lib/messages.js within the compile() and merge() functions, which fail to reject a __proto__ language key. This allows attackers to modify the prototype of compiled messages, potentially altering or breaking validation error rendering and related logic. The issue is fixed in versions 17.13.9 and 18.3.1.
CESNET ipfixcol2 versions 2.3.0 up to but not including 2.9.0 contain an integer overflow vulnerability in the Forwarder output plugin. This flaw allows unauthenticated IPFIX exporters to overflow a heap buffer by wrapping uint16_t message length counters. Attackers can exploit this by sending near-65535-byte data sets and large templates to a collector forwarding over TCP, potentially causing a crash and enabling 2-byte writes to attacker-controlled memory addresses. The vulnerability is fixed in version 2.9.0.
CESNET ipfixcol2 versions 2.7.1 up to but not including 2.9.0 contain a memory allocation vulnerability in the Lz4Decoder::read_start_header() function. This flaw allows unauthenticated attackers to cause excessive memory allocation by sending LZ4 start headers with very large buffer sizes, potentially exhausting up to 4 GiB of memory per TCP connection. The issue can lead to denial of service by exhausting collector service resources. The vulnerability is fixed in version 2.9.0.
CESNET ipfixcol2 versions 2.7.1 up to but not including 2.9.0 contain a heap-based buffer overflow vulnerability in the Lz4Decoder.cpp component. This flaw allows unauthenticated network peers to write beyond allocated heap buffers by manipulating buffer size parameters, potentially crashing the collector or causing other memory corruption issues. The vulnerability is fixed in version 2.9.0.
A heap-based buffer overflow vulnerability exists in reSIProcate reTurn client versions up to 1.14.0 in the TurnTcpSocket::handleReadHeader() function. Malicious TURN servers can exploit this by sending STUN or ChannelData frames with oversized declared lengths, causing memory overwrite beyond the allocated buffer and crashing the client.
CVE-2026-121969 is a stack-based buffer overflow vulnerability in netrek-client-cow versions up to 3.3.3. The flaw exists in the handleSMessage() function in short.c, where oversized SP_S_MESSAGE packets can overflow a 100-byte stack buffer. This vulnerability allows a malicious Netrek server or a man-in-the-middle attacker on the plaintext TCP connection to send specially crafted messages that overwrite stack memory, potentially crashing the client.
Netrek-client-cow versions up to 3.3.3 have an out-of-bounds read vulnerability in the short.c handleSMessage() function. This flaw allows malicious Netrek servers or attackers intercepting the TCP connection to send crafted SP_S_MESSAGE packets with an unchecked m_recpt index of 36 or higher. Exploitation can cause the client to read beyond array bounds, leading to a denial of service via client crash.
vtenext versions 25.02 prior to 25.02.1 contain a critical authentication bypass vulnerability. This flaw allows unauthenticated attackers to change any account password without token verification by exploiting the hub/rpwd.php endpoint. Attackers who know a valid username can send a password change request and gain administrator access if two-factor authentication is not enabled. The vulnerability is fixed in version 25.02.1.
vtenext versions prior to 25.02.2 contain an SQL injection vulnerability in the modules/Fax/EditView.php component. Authenticated users with low privileges can exploit this flaw by supplying a crafted fieldname parameter, enabling them to read arbitrary database contents, including sensitive password reset tokens. This could lead to account takeover of other users. The vulnerability is rated high severity with a CVSS score of 8.6. A fix is available in version 25.02.2.
CVE-2025-71455 is a vulnerability in vtenext versions before 25.02.2 that exposes session identifiers via the Touch web service endpoint. This exposure allows attackers who can execute scripts within the vtenext origin, such as through cross-site scripting, to bypass the HttpOnly flag and hijack authenticated sessions.
vtenext versions before 25.02.2 are vulnerable to a cross-site request forgery (CSRF) protection bypass. The vulnerability arises because the csrf_check() function skips CSRF token validation for non-POST requests, allowing attackers to trick logged-in users into executing state-changing GET requests. This can lead to unauthorized actions performed with the user's privileges.
vtenext versions prior to 25.02.2 contain a reflected cross-site scripting (XSS) vulnerability in the HomeWidgetBlockList.php module. The flaw arises from unsanitized widgetId keys in the widgetInfoList JSON parameter being echoed directly, allowing attackers to inject malicious HTML/JavaScript. Exploitation requires a logged-in user to submit a crafted POST request, which results in script execution within the victim's session. This vulnerability is fixed in version 25.02.2.
A vulnerability in telepresence versions prior to 2.31.0 allows an attacker to bypass authorization by using a user-controlled session ID. The Traffic Manager Tunnel gRPC streaming endpoint does not verify ownership of the session ID parsed from incoming messages, enabling attackers who obtain a valid session ID to hijack network routing capabilities. This issue is fixed in version 2.31.0.
CVE-2026-122009 is a server-side request forgery (SSRF) vulnerability in DataLinkDC Dinky versions 1.2.0 through 1.2.5. It affects the FlinkWebURITemplateProxyServlet.getNewTargetUri function in the flink_web Proxy Endpoint component. The vulnerability allows remote attackers to manipulate the _authority argument to induce SSRF. Exploit code has been published, but no in-the-wild exploitation has been confirmed. The vulnerability has a medium severity rating with a CVSS 4.0 score of 6.9.
The nminer package version 3.0.0 on npm contains malicious code that can fully compromise any computer on which it is installed or running. This compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Removal of the package does not guarantee elimination of all malicious software introduced by its installation.
IBM MQ versions 9.2.0.0 through 9.2.0.44 LTS, 9.3.0.0 through 9.3.0.42 LTS, 9.4.0.0 through 9.4.0.26 LTS, 9.4.0.0 through 9.4.5.1 CD, and 10.0.0.0 through 10.0.0.5 LTS and CD contain a vulnerability in the XMS .NET client. This flaw allows an authenticated attacker to execute arbitrary code on consumer applications due to insecure deserialization of ObjectMessage payloads.