A vulnerability in Erlang/OTP inets httpd allows remote unauthenticated attackers to bypass authentication and read files inside mod_auth protected directories on case-insensitive filesystems by exploiting improper handling of case sensitivity in request paths. This affects multiple versions of Erlang/OTP from 17.0 up to but not including patched versions 27.3.4.17, 28.5.0.6, and 29.0.6. The issue arises because the authentication check does not consider case-insensitive matches, while the filesystem resolves paths case-insensitively, allowing unauthorized access. A fix is available and has been released by Ubuntu in security updates.
CVE-2026-73276 is a high-severity vulnerability in Erlang OTP that involves inconsistent interpretation of HTTP requests, specifically in the Gracefulness code. This flaw allows HTTP Request Smuggling attacks by ignoring certain cases that should have been rejected. The vulnerability affects multiple OTP versions from 22.2 up to but not including 27.3.4.17, 28.0 up to but not including 28.5.0.6, and 29.0 up to but not including 29.0.6, as well as corresponding inets versions. It has a CVSS 4.0 score of 8.3, indicating high severity. No vendor advisory or patch information is currently available.
CVE-2026-55951 is a high-severity vulnerability in the Erlang/OTP httpc HTTP client where no limit is enforced on the total size of response headers from a server. This allows a malicious or compromised HTTP server to send an arbitrarily large number or size of headers, causing unbounded memory allocation in the client process. This can lead to system memory exhaustion or a crash of the BEAM VM. The vulnerability affects multiple OTP versions from 17.0 up to but excluding 27.3.4.17, 28.0 up to but excluding 28.5.0.6, and 29.0 up to but excluding 29.0.6, as well as corresponding inets versions. Any application using httpc:request/4,5 to connect to untrusted servers is vulnerable without requiring authentication.
CVE-2026-74835 is a high-severity vulnerability in the Erlang OTP inets HTTP server where the configured body-size limit on chunked HTTP requests is not enforced. This flaw allows resource exhaustion due to allocation without limits or throttling. The issue affects multiple OTP and inets versions and has a CVSS 4.0 base score of 8.7. The vulnerability is fixed in OTP versions 27.3.4.17, 28.5.0.6, 29.0.6 and inets versions 9.3.2.7, 9.6.2.3, and 9.7.2. No known exploits are reported in the wild.
Missing Release of Resource after Effective Lifetime vulnerability in Erlang/OTP inets httpd allows an unauthenticated remote attacker to cause denial of service by sending a request with a chunked body whose chunk-size line is not a hexadecimal number. The worker serving the connection is never released and no timeout reclaims it, so repeating the request across connections occupies every available worker and denies service to legitimate clients. No authentication is required and the default configuration is affected.
The chunk-size line must arrive in a write separate from the headers. When the body accompanies the headers, httpd_request_handler:handle_body/3 calls http_chunk:decode/3 inside a try ... catch throw:Error, so the {error, {chunk_size, _}} thrown by http_chunk:decode_size/4 is answered with 400 Bad Request. When the chunk size arrives later, the decoder is resumed through a bare catch in httpd_request_handler:handle_info/2, which converts the throw into a return value rather than raising it; the resulting error tuple is then treated as the next decoder continuation, the socket is re-armed, and the worker waits for data that never comes. The request timeout has already been cancelled at the point the headers were accepted, and the periodic byte-rate check is only armed when minimum_bytes_per_second is configured, which it is not by default.
This issue affects OTP from OTP 18.1.4 before OTP 27.3.4.17, OTP 28.5.0.6, and OTP 29.0.6, corresponding to inets from 6.0.3 before 9.3.2.7, 9.6.2.3, and 9.7.2.
CVE-2026-70409 is a medium-severity vulnerability in Erlang/OTP's eldap module involving improper validation of the port component in LDAP referral URLs. A malicious or compromised LDAP server can supply a referral URL with an excessively long numeric port, causing the eldap:parse_port/2 function to perform costly arbitrary-precision integer conversions. This can degrade application availability by consuming significant processing time. The flaw affects multiple OTP versions from 17.0 up to but excluding patched versions 27.3.4.17, 28.5.0.6, and 29.0.6, as well as corresponding eldap library versions. Exploitation requires the application to pass server-supplied referrals to eldap:parse_ldap_url/1, which eldap itself does not call internally. No known exploits are reported in the wild.
CVE-2026-59696 is a medium severity vulnerability in Erlang/OTP's stdlib where improper validation of the port component in a URI allows a remote attacker to degrade service availability. The vulnerability arises because the function uri_string:get_port/1 converts a very long numeric port string to an integer without length bounds, causing excessive CPU consumption. This affects all applications parsing attacker-supplied URIs using uri_string:parse/1. The issue impacts OTP versions from 21.0 up to but not including 27.3.4.17, 28.0 up to 28.5.0.6, and 29.0 up to 29.0.6, as well as corresponding stdlib versions. No exploits are known in the wild, and no explicit patch links are provided in the data.
The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.17. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to retrieve the name, price, short description, image URL, permalink, stock status, and product type of draft, pending, private, and catalog-hidden WooCommerce products not intended to be publicly visible. The sidebarNonce value is emitted unconditionally into public page HTML by multiple block renderers with no login gate, allowing unauthenticated visitors to harvest a valid nonce and pass the only authentication check in the handler.
Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash discloses the stored value of a confirmed field to an actor who fails its confirmation check.
Ash.Resource.Validation.Confirm's atomic implementation (atomic/2 in lib/ash/resource/validation/confirm.ex) built the mismatch error with its value set to the field being confirmed. When the actor supplies only the confirmation argument and not the field itself, value resolves through atomic_ref/2 to the field's current stored value, so the mismatch error echoes that stored value back to the actor. Against a confirmation guarding a sensitive attribute, an actor can submit a deliberately wrong confirmation and read the real value from the returned error. The fix reports the actor-supplied confirmation in the error instead of the stored field value.
This issue affects ash: from 2.17.20 before 3.32.2.
A vulnerability was determined in QuantumNous new-api up to 1.0.0-rc.15. Affected by this issue is some unknown functionality of the file /api/usage/token/ of the component Revoked API Token Handler. Executing a manipulation can lead to session expiration. The attack may be performed from remote. The exploit has been publicly disclosed and may be utilized. Upgrading to version 1.0.0-rc.17 can resolve this issue. This patch is called 0d5995eb63f8801d32eb32fbe74b75b68752bfa9. The affected component should be upgraded.
Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server/api/project/handler.go accept a project or project-file row id from the JSON body and act on it without checking that the project belongs to the caller's namespace. The corresponding model.ProjectFile.GetData and model.Project.GetData queries filter only by row id. A user holding the manager role (or any role that includes the FileSync / EditProject permission) in their own namespace can read, write, or delete files in any project across the install, and can rewrite any project's git remote URL by submitting the foreign id in the body. The git-URL primitive escalates to RCE on the next deploy because Edit runs git remote set-url on the project's working tree. At time of publication, there are no known publicly available patches.
The npm package @pipi596888/ccursor versions 0.0.16 and 0.0.17 contain malicious code or depend on a malicious package. Installation or execution of this package can lead to full compromise of the affected computer, potentially exposing all stored secrets and keys. Removal of the package does not guarantee elimination of all malicious software introduced. Immediate secret and key rotation from a different, uncompromised system is strongly advised.
CVE-2026-77966 is a high severity vulnerability in the Ebyte NA111-M Firmware version 9013-2-17. It involves missing authorization controls that allow a low privileged authenticated attacker to access and modify sensitive configuration settings. This flaw affects the confidentiality, integrity, and availability of the device.
CVE-2026-76133 is a critical vulnerability in the Ebyte NA111-M Firmware version 9013-2-17. It involves the use of a deprecated hashing algorithm in an authentication-related operation, which may allow attackers to bypass authentication controls. The vulnerability has a CVSS score of 9.8, indicating a high impact on confidentiality, integrity, and availability. No patch or remediation information is currently available, and no exploits are known in the wild.
CVE-2026-77975 affects the Ebyte NE2-D11 Firmware version 9013-2-17. The vulnerability involves exporting administrative credentials and sensitive configuration information without adequate protection. An unauthenticated attacker on the adjacent network who obtains the exported configuration file could recover valid credentials and access the device or similarly configured systems. The CVSS score is 6.5, indicating a medium severity vulnerability with high confidentiality impact but no integrity or availability impact.
ProfilePress (wp-user-avatar) WordPress plugin versions before 4.17.2 contain a critical unauthenticated remote code execution vulnerability. Attackers can brute-force a weak 32-bit connect token via the ppress_connect_process AJAX handler to install and activate arbitrary plugins silently. This leads to PHP code execution with the web-server user's privileges.
CVE-2026-82727 is a vulnerability in ash-project's ash_phoenix component where error messages generated during form processing leak sensitive information. Specifically, when a union sub-form receives an unexpected _union_type value, the entire submitted parameter map, including secrets like passwords, is embedded in the exception message. This sensitive data is exposed in logs, crash reports, and developer error pages because the message bypasses Phoenix's parameter filtering. The issue affects versions from 1.2.17 up to but not including 2.3.25.
The Newsletters WordPress plugin before version 4.17 uses an insufficiently random source to generate its API key, deriving it from a publicly known value. This weakness allows unauthenticated attackers to compute the API key and perform privileged actions such as adding or deleting subscribers and sending emails when the optional API is enabled. The vulnerability is classified as CWE-326 (Inadequate Encryption Strength) and has a CVSS score of 4.8, indicating medium severity.
Hermes Agent versions 0.16.0 up to but not including 0.17.0 contain a vulnerability where attackers can bypass path restrictions to overwrite the credential store file auth.json. This improper path restriction allows crafted messages to direct file-write operations to sensitive files, enabling credential tampering or unauthorized access. The vulnerability has a high severity score of 7.6 and requires user interaction but no privileges. No official patch or remediation guidance is currently confirmed.
CVE-2026-55245 is a Server-Side Request Forgery (SSRF) vulnerability in maximhq bifrost, an enterprise AI gateway. The issue arises from incorrect classification of certain IP address ranges as public in the isPublicIP function prior to version 1.5.17. This misclassification allows a remote attacker controlling a multimodal request URL to make the gateway fetch internal services, including cloud instance metadata endpoints encoded via IPv6 6to4 or NAT64. The vulnerability has a high severity with a CVSS score of 8.7 and is fixed in version 1.5.17.