CVE-2026-111497 is a critical buffer overflow vulnerability in the Brotli decoder component of Keycloak. It affects multiple packages and allows for potential remote code execution or denial of service. The flaw exists in the c/dec/decode function of the Brotli decoder. Fixed versions 26.4.2-r4 and 26.7.5-r3 address this issue.
CVE-2026-117656 is an authentication bypass vulnerability in the Sign in with Apple strategy of the pow-auth Assent library. It allows an unauthenticated remote attacker to impersonate another user by manipulating the user parameter in the authorization callback. The vulnerability arises because the user parameter, which is controlled by the client, is merged over verified ID token claims without proper validation, enabling attackers to replace critical identity claims such as subject and email. This affects versions from 0.1.25 up to but not including 0.3.2. The issue is fixed in version 0.3.2.
A path traversal vulnerability in the Signal K server's resources API allows unauthenticated or low-privileged users to read, write, and delete files outside the intended storage directory. This includes reading the security.json file containing the JWT signing secret, enabling attackers to forge admin JWT tokens and gain administrative access. With admin privileges, attackers can create providers that execute arbitrary shell commands, resulting in remote code execution with server privileges. The vulnerability affects all signalk-server versions prior to 2.34.0 and resources-provider versions prior to 1.5.3. The issue is patched in versions 2.34.0 and 1.5.3.
An integer overflow vulnerability exists in the ICO loader of imgproxy before version 4.0.16. The flaw occurs when a 32-bit attacker-controlled data size is added to a constant header length, causing an allocation size wraparound and resulting in a heap overflow. This can lead to denial of service or potentially remote code execution when processing a crafted ICO image.
CVE-2026-63377 is a critical vulnerability in TAKO AI Agent for Okta versions prior to 3.0.1-beta. It allows unauthenticated network attackers to create the first administrator account via the POST /api/auth/setup endpoint before the legitimate owner completes initial setup. This occurs because the setup endpoint lacks authentication, one-time tokens, or network restrictions, and the default deployment exposes the service on all network interfaces. Exploitation grants full administrative control, including reading sensitive data, modifying users and credentials, and locking out legitimate administrators. The issue is fixed in version 3.0.1-beta.
A critical stack-based buffer overflow and missing authorization vulnerability exists in Thales Sentinel Keys Server on Windows versions prior to 1.3.8.0. The vulnerability arises because the server does not validate the length of the first field in an HTTP request, allowing an attacker to craft a malicious request that may lead to remote code execution with NT AUTHORITY\SYSTEM privileges.
An unauthenticated PHP Object Injection vulnerability exists in LeadSnap versions up to and including 1.25. This vulnerability allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.
CVE-2026-39738 is a critical unauthenticated PHP Object Injection vulnerability affecting FunnelKit Automations versions up to and including 3.8.6.1. This flaw allows remote attackers to inject malicious PHP objects without authentication, potentially leading to full system compromise.
CVE-2026-39732 is an unauthenticated SQL Injection vulnerability affecting Transliterator versions up to and including 2.5.13. This flaw allows an attacker to execute SQL injection attacks without authentication, potentially leading to high confidentiality impact and partial availability impact.
A deserialization of untrusted data vulnerability in ThemeREX Royal Event allows object injection, potentially leading to full system compromise. The vulnerability affects versions up to 2.0. It has a critical CVSS score of 9.8, indicating high impact on confidentiality, integrity, and availability.
CVE-2026-116852 is a critical remote code execution vulnerability affecting Widget Options versions up to and including 4.2.5. It allows an authenticated author-level user to execute arbitrary code on the affected system without user interaction. The vulnerability is identified as CWE-94, indicating improper control of code generation. No specific affected versions beyond "<= 4.2.5" are provided, and no patch or remediation details are available in the input data.
CVE-2026-116386 is a critical unauthenticated privilege escalation vulnerability affecting SMS Alert Order Notifications versions up to and including 4.0.2. This flaw allows an attacker to escalate privileges without authentication, potentially leading to full compromise of confidentiality, integrity, and availability.
CVE-2026-62863 is a critical vulnerability in gojue moling prior to version 0.5.0. When running in SSE mode with the `-l` option, the `/sse` and `/message` HTTP endpoints do not authenticate requests and allow cross-origin resource sharing from any domain. This permits a malicious web page to obtain a session ID via a cross-origin EventSource connection and then use that session ID to send unauthorized commands to the server. These commands can potentially read or write local files, execute commands, or perform other sensitive actions. The vulnerability is fixed in version 0.5.0.
ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the `TDengine TDS APIs` allows request-controlled JSON field values submitted to `/anyUser/tds/insertTableData` to reach unsafe SQL construction in the `TDS mapper`. A remote unauthenticated attacker can tamper with TDengine time-series data, including inserting unintended rows or overwriting existing readings. The affected surface is the TDS module's insert-table-data flow and TDengine mapper SQL generation. This issue is fixed in version 1.4.0.
CVE-2026-62853 is a critical OS command injection vulnerability in the mqttsnet ThingLinks enterprise IoT platform. Versions prior to 1.4.0 allow authenticated users to submit Groovy scripts to the /groovyScriptTest/registerScript endpoint, which are compiled and executed without sandboxing. This enables arbitrary server-side code execution. The vulnerability is fixed in version 1.4.0.
The pypi-publish GitHub Action versions before 1.14.3 included the emSign root CA certificate via the certifi bundle, which has since been removed. This change affects the TLS trust store used by Sigstore for Trusted Publishing and Digital Attestations. The vulnerability is tracked due to the revocation of this CA in the chain that Sigstore relies on. A fix is available in version 1.14.3.
CVE-2026-117666 is a critical vulnerability in the deadtrickster ssl_verify_fun library affecting versions from 1.0.1 up to but not including 1.1.8. It involves improper validation of TLS certificates with host mismatches due to incorrect wildcard matching, allowing an attacker in a man-in-the-middle position to impersonate a TLS peer. The issue arises because the wildcard matching function accepts partial-label wildcards that consume dots, violating RFC 6125 constraints. Erlang/OTP 20.0 and later mitigate this if server_name_indication (SNI) is enabled, but clients disabling SNI or servers using this library for client certificate hostname verification remain vulnerable. A fix is available in version 1.1.8.
HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL `DSL` by calling `keyword` or `symbol` on that input can produce SQL strings that facilitate SQL injection when executed unchanged by a `JDBC` driver. Some formatters do not apply the existing suspicious-character check to the resulting entity names. The impact depends on the privileges of the database connection executing the generated statement. Input validation before constructing `keyword` or `symbol` entities is a workaround. The maintainer-designated fixed version is 2.7.1392.
CVE-2026-116241 is a critical OS command injection vulnerability in pgAdmin 4's Import/Export Data tool affecting versions before 9.19. The flaw arises from improper handling of backslashes inside double-quoted identifiers during query export, allowing an attacker to bypass input validation and execute arbitrary OS commands on the pgAdmin host with the privileges of the pgAdmin process. This vulnerability bypasses a previous fix (CVE-2026-17566) and can be exploited by any database role with Import/Export Data permission, which is granted to non-administrators by default. The issue is fixed in pgAdmin 4 version 9.19.