CVE-2026-40228 is a low-severity vulnerability in systemd version 259 where systemd-journald can send ANSI escape sequences to terminals of arbitrary users when the 'logger -p emerg' command is executed and ForwardToWall=yes is set. This behavior is due to incorrect resource transfer between security spheres.
CVE-2026-35545 is a medium severity vulnerability in Roundcube Webmail versions before 1.5.15 and 1.6.15. It allows bypassing the remote image blocking feature through specially crafted SVG content in email messages, specifically using the animate element with attributeName set to fill, filter, or stroke. This vulnerability may lead to information disclosure or access-control bypass. No official patch or remediation level has been confirmed yet, and no known exploits are reported in the wild.
CVE-2026-35544 is a medium severity vulnerability in Roundcube Webmail versions before 1.5.14 and 1.6.14. It involves insufficient sanitization of CSS in HTML email messages, allowing a bypass of fixed-position mitigations through the use of the ! important CSS directive. This vulnerability does not impact confidentiality or availability but can lead to integrity issues. No official patch or remediation level has been confirmed yet, and no known exploits are reported in the wild.
CVE-2026-35543 is a medium severity vulnerability in Roundcube Webmail versions before 1.5.14 and 1.6.14. It allows bypassing the remote image blocking feature by using SVG content with animate attributes in email messages. This bypass can lead to information disclosure or access-control bypass. No official patch or remediation level has been confirmed yet. There are no known exploits in the wild at this time.
CVE-2026-35542 is a medium severity vulnerability in Roundcube Webmail versions before 1.5.14 and 1.6.14. It allows bypassing the remote image blocking feature through a crafted background attribute in the BODY element of an email message. This bypass can lead to information disclosure or access-control bypass. The vulnerability is related to incorrect resource transfer between security spheres (CWE-669). No official patch or remediation level has been confirmed yet.
CVE-2026-35540 is a medium severity vulnerability in Roundcube Webmail versions before 1.6.14. It involves insufficient sanitization of CSS in HTML email messages, which may allow server-side request forgery (SSRF) or information disclosure if stylesheet links reference local network hosts. The vulnerability affects Roundcube Webmail 1.6.0 and has a CVSS score of 5.4. No official patch or remediation information is currently available from the vendor. There are no known exploits in the wild at this time.
CVE-2025-41660 is a high-severity vulnerability in CODESYS Control RTE (SL) that allows a low-privileged remote attacker to replace the boot application of the runtime system. This unauthorized modification can lead to execution of arbitrary code with potentially full control over the affected system. The vulnerability is classified under CWE-669, indicating incorrect resource transfer between security spheres. No patch or official remediation information is currently provided.
An issue was discovered in OpenStack Nova before 30.2.2, 31 before 31.2.1, and 32 before 32.1.1. By writing a malicious QCOW header to a root or ephemeral disk and then triggering a resize, a user may convince Nova's Flat image backend to call qemu-img without a format restriction, resulting in an unsafe image resize operation that could destroy data on the host system. Only compute nodes using the Flat image backend (usually configured with use_cow_images=False) are affected.
Dify 1.9.1 and 1.17.0 exposes the /console/api/system-features endpoint to unauthenticated HTTP GET requests that return system feature and configuration information. NOTE: The maintainer states that the endpoint is unauthenticated by design and serves as a bootstrap mechanism required for the dashboard initialization. They also state that the data is non-sensitive and required for client-side rendering. No PII, credentials, or secrets are exposed.
Edge3 Worker RPC RCE on Airflow 2.
This issue affects Apache Airflow Providers Edge3: before 2.0.0 - and only if you installed and configured it on Airflow 2.
The Edge3 provider support in Airflow 2 has been always development-only and not officially released, however if you installed and configured Edge3 provider in Airflow 2, it implicitly enabled non-public (normally) API which was used to test Edge Provider in Airflow 2 during the development. This API allowed Dag author to perform Remote Code Execution in the webserver context, which Dag Author was not supposed to be able to do.
If you installed and configured Edge3 provider for Airflow 2, you should uninstall it and migrate to Airflow 3. The new Edge3 provider versions (>=2.0.0) has minimum version of Airflow set to 3 and the RCE-prone Airflow 2 code is removed, so it should no longer be possible to use the Edge3 provider 2.0.0+ on Airflow 2.
If you used Edge Provider in Airflow 3, you are not affected.
The Restaurant Brands International (RBI) assistant platform through 2025-09-06 allows remote attackers to review the stored audio of conversations between associates and Drive Thru customers.
XMLUnit for Java before 2.10.0, in the default configuration, might allow code execution via an untrusted stylesheet (used for an XSLT transformation), because XSLT extension functions are enabled.
In SonarQube before 25.6, 2025.3 Commercial, and 2025.1.3 LTA, authenticated low-privileged users can query the /api/v2/users-management/users endpoint and obtain user fields intended for administrators only, including the email addresses of other accounts.
The EKEN video doorbell T6 BT60PLUS_MAIN_V1.0_GC1084_20230531 periodically sends debug logs to the EKEN cloud servers with sensitive information such as the Wi-Fi SSID and password.
Click Studios Passwordstate before 9.9 Build 9972 has a potential authentication bypass for Passwordstate emergency access. By using a crafted URL while on the Emergency Access web page, an unauthorized person can gain access to the Passwordstate Administration section.
In guix-daemon in GNU Guix before 1618ca7, a content-addressed-mirrors file can be written to create a setuid program that allows a regular user to gain the privileges of the build user that runs it (even after the build has ended).
In One Identity OneLogin before 2025.3.0, a request returns the OIDC client secret with GET Apps API v2 (even though this secret should only be returned when an App is first created),
Plex Media Server (PMS) 1.41.7.x through 1.42.0.x before 1.42.1 is affected by incorrect resource transfer between spheres because /myplex/account provides the credentials of the server owner (and a /api/resources call reveals other servers accessible by that server owner).