fzf versions 0.36.0 through 0.74.5 have an inefficient algorithmic complexity vulnerability in the maskActionContents function. This flaw allows local attackers to exhaust the --listen HTTP server by sending large POST requests repeatedly, causing the single-threaded server to block for about 30 seconds each time. The vulnerability results in a denial of service condition but does not impact confidentiality or integrity.
A vulnerability in GNU patch allows an attacker to create files arbitrarily outside the intended working directory by using specially crafted patch files. This occurs due to missing validation of absolute file paths during automatic patch reversal, enabling file creation with the permissions of the executing user. The flaw affects multiple specific versions of the patch utility. No official fix or mitigation meeting Red Hat's criteria is currently available.
Red Hat has released version 3.11.3 of its OpenShift distributed tracing platform (Tempo), which upgrades Tempo to version 2.10.10 and includes security improvements. There are no breaking changes, deprecations, or bug fixes noted in this release. The advisory references CVE-2026-108859 and CVE-2026-111943 but does not detail specific vulnerabilities or fixes. No known exploits are reported in the wild. The update is classified as important and addresses security concerns.
Lotus versions up to 0.10.2 contain an authorization bypass vulnerability in the ChangeUserOrganizationView.post endpoint. Authenticated users can supply any organization's UUID to join that organization without proper authorization, potentially accessing tenant data and billing configurations of other organizations.
CVE-2026-115333 is an improper authentication vulnerability in the uselotus lotus product up to version 0.10.2. The flaw exists in the Go event ingestion middleware, which validates API keys by prefix only and does not verify the secret against the stored hashed key. This allows attackers who know or obtain an API key prefix to submit usage events as that organization, potentially altering metered usage and billing.
Lotus versions up to 0.10.2 have an SQL injection vulnerability that allows authenticated users to inject SQL via crafted subscription_filter_keys. This bypasses keyword-only validation and enables attackers to manipulate usage aggregation queries in the multi-tenant database. The vulnerability is fixed in version 0.10.3.
Lotus versions up to 0.10.2 contain an SQL injection vulnerability that allows authenticated organization users to execute arbitrary SQL commands by appending stacked statements to custom metric queries. The vulnerability arises because the application accepts semicolon-separated SQL statements via the POST /app/metrics/ endpoint and only validates the first statement, enabling bypass of input validation. This flaw can lead to unauthorized reading or modification of data across all tenants.
CVE-2026-115329 is an authorization bypass vulnerability in the uselotus lotus product up to version 0.10.2. The flaw exists in SubscriptionViewSet.get_object(), which uses an unscoped queryset lacking organization filtering or permission checks. This allows authenticated users or API keys from any organization to access and modify subscription data belonging to other organizations, including reading, canceling, updating, switching plans, or modifying addons.
Weaver E-cology versions 8.0, 9.0, and 10.0 prior to 10.76 contain an unauthenticated SQL injection vulnerability in the /api/doc/out/more/list endpoint via the elementmore parameter with srcType=2. Attackers can exploit this flaw by injecting SQL through the doc_datefrom and doc_dateto fields and retrieve database information via the /api/ec/dev/table/counts endpoint. The vulnerability was first observed exploited in the wild by the Shadowserver Foundation on 2026-07-19. A fix is available in version 10.76.
Retool before 3.88.0 contains a cross-site scripting vulnerability that allows unauthenticated attackers to execute scripts by proxying malicious SVG files through /api/imageProxy. Attackers can supply an attacker-hosted SVG in the url parameter, which is served from the Retool origin without a Content Security Policy, executing JavaScript in victims' sessions. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-10-15.
A vulnerability in webpack-dev-server versions from 5.1.0 before 5.2.7 and version 6.0.0 allows unauthenticated attackers to trigger an exception via a specially crafted Host header to the open-editor endpoint. This causes the server to return an HTTP 500 error with a full exception stack trace that discloses sensitive information such as absolute filesystem paths and internal source line numbers. The server remains operational after the error. The issue is fixed in versions 5.2.7 and 6.1.0.
In webpack-dev-server versions before 5.2.7 and version 6.0.0, a vulnerability exists in the proxy WebSocket forwarding feature. The server forwards non-HMR WebSocket upgrade requests to the proxy target without validating Host or Origin headers, bypassing allowedHosts protections. This allows a malicious web page visited by a developer to open a cross-origin WebSocket through the dev server and interact with the proxied backend, even if the server is bound to loopback. The issue is fixed in versions 5.2.7 and 6.1.0.
A low-severity vulnerability (CVE-2026-114459) was found in mod_qos versions 11.76-4, 11.76-5, 11.76-6, 11.77-1, 11.78-1, 11.79-1, and 11.79-1build1. The flaw relates to inspecting HTTP response bodies and results in a low impact on availability. No known exploits are reported in the wild.
A vulnerability in mod_qos allows an unauthenticated remote attacker to cause a denial of service. The flaw affects specific versions of mod_qos and has a medium severity rating with a CVSS score of 5.9. There is no indication of confidentiality or integrity impact, only availability is affected. No known exploits are reported in the wild, and no patch or remediation details are provided in the available data.
A vulnerability exists in mod_qos versions 11.76-4 through 11.79-1build1 that allows an unauthenticated remote attacker to cause a denial of service. The flaw does not impact confidentiality or integrity but can affect availability. The CVSS score is low (3.7) reflecting the limited impact and the requirement for high attack complexity.
CVE-2026-114177 is a Cross-Site Request Forgery (CSRF) vulnerability in Xpro Elementor Addons affecting versions from initial release up to 1.7.10. This flaw allows attackers to perform unauthorized actions on behalf of authenticated users. The vulnerability has a high severity with a CVSS score of 8.8. A fix is available in version 1.7.11.
A vulnerability in Roundcube was fixed that addressed a bug where an alias login was not properly qualified by the IMAP host. This flaw could allow an attacker with low privileges to gain unauthorized access under certain conditions. The issue affects multiple specific versions of Roundcube. The CVSS score is 6.8, indicating a medium severity impact with high confidentiality and integrity impact but no availability impact.
A vulnerability in Roundcube involves the CSS proxy content processing lacking a size limit, potentially leading to denial of service conditions. The issue affects multiple specific versions of Roundcube. The CVSS score is 5.3, indicating a medium severity impact primarily affecting availability. No known exploits are reported in the wild, and no patch or remediation details are provided in the available data.
A Server-Side Request Forgery (SSRF) vulnerability in Roundcube allows bypass of the is_local_url() filter via NAT64 64:ff9b::/96 addresses. This vulnerability affects multiple specific versions of Roundcube and has a high severity rating with a CVSS score of 7.2. The flaw could allow an attacker to cause the server to make unauthorized requests, potentially leading to information disclosure or other impacts.
A vulnerability in Roundcube allows bypassing remote content blocking via SVG SMIL by attribute. This issue affects multiple specific versions of Roundcube and has a medium severity rating with a CVSS score of 5.3. The vulnerability does not require privileges or user interaction to exploit and impacts confidentiality without affecting integrity or availability.