CVE-2026-118697 is a critical vulnerability in JetBrains Toolbox App and several JetBrains IDEs where the jetbrainsd daemon improperly validates certificates, trusting compromised intermediate certificates. This affects versions before the specified fixed releases. The flaw allows an attacker to potentially perform man-in-the-middle attacks, compromising confidentiality, integrity, and availability.
FlowiseAI Flowise versions up to 3.1.4 contain a sandbox escape vulnerability that allows authenticated users to execute arbitrary OS commands. This occurs when the ALLOW_BUILTIN_DEP environment variable is set to true, enabling abuse of allowlisted langchain and mammoth modules. Attackers can submit JavaScript code to the /api/v1/node-custom-function endpoint, which writes a file into the mammoth package via LocalFileStore and requires it, thereby escaping the vm2 sandbox with the privileges of the Flowise process user.
Bazarr versions prior to 1.5.7-beta.14 contain multiple Cross-Site Request Forgery (CSRF) vulnerabilities in the Plex API namespace due to missing authentication on certain resource handlers. This allows anonymous attackers to perform unauthorized API actions such as clearing credentials, persisting attacker-chosen API keys, and modifying configuration settings without proper authorization. These flaws enable persistent configuration tampering, denial of service of the Plex integration, and potential server-side request forgery with credential exposure. Version 1.5.7-beta.14 addresses the anonymous API mutation by adding authentication, though some OAuth state validation issues remain.
Multiple critical vulnerabilities have been identified and fixed in Red Hat Identity Management (IdM), also known as FreeIPA. These include unauthenticated denial-of-service, privilege escalation, cross-site scripting allowing arbitrary code execution, unauthorized LDAP writes, and unauthorized credential access. The vulnerabilities affect Red Hat Enterprise Linux Server Extended Lifecycle Support 7 and related architectures. Red Hat has released security updates addressing these issues.
CVE-2026-112816 is a critical vulnerability in Canonical LXD affecting versions 4.0.14 through before 4.0.15, 5.0.10 through before 5.0.11, 5.21.8 through before 5.21.9, and 6.9 through before 6.10.1. It involves improper certificate validation in the HTTPS listener, allowing an unauthenticated attacker to impersonate any trusted client. This flaw enables full access to the cluster and managed virtual machines via a crafted certificate chain. The issue is fixed in versions 4.0.15, 5.0.11, 5.21.9, and 6.10.1.
Python's ssl module has been updated to include a denylist of known compromised intermediate certificates. This enhancement ensures that these certificates are automatically rejected, improving security even if certificate revocation is not configured. The vulnerability affects multiple Python versions prior to their respective fixed releases.
Parse Server versions before 8.6.102 and from 9.0.0 up to but not including 9.10.5 contain an authentication bypass vulnerability. This occurs because custom AuthAdapter subclasses do not have their validateSetUp, validateLogin, and validateUpdate methods called, causing the system to fall back to a default that accepts any authentication data. This flaw allows attackers to supply arbitrary authentication data to sign up, link identities, log in as existing users, or bypass additional authentication factors.
MuseBot versions before 2.0.0 have an authentication bypass vulnerability due to a hard-coded default session key. This flaw allows unauthenticated attackers to forge admin sessions by signing a session cookie with the known default key. Successful exploitation grants full administrative access, including reading password hashes, chat records, bot configuration, and the ability to stop bots.
OpenDeepWiki versions up to 2.0.6 have a vulnerability due to a hard-coded JWT signing key. This flaw allows unauthenticated attackers to forge administrator tokens by using the publicly known Jwt:SecretKey found in appsettings.json. Exploiting this, attackers can create HS256 bearer tokens with admin privileges, enabling full control over administrative API endpoints including user, role, repository, settings, and API key management.
CallBackery versions before 0.62.0 for Perl are vulnerable to log injection via newlines in the login name. The login() function writes the login name to application logs without escaping control characters, allowing an unauthenticated attacker to forge log records, including fake administrator login entries.
CallBackery versions prior to 0.62.0 for Perl contain a vulnerability in the createRxValidator function where form field validation patterns are improperly constructed. This allows authenticated users to submit values that should be rejected by the intended pattern checks. Such values may then be written into generated configuration files, potentially leading to security issues related to configuration integrity.
HTTP::Parser::XS versions before 0.18 for Perl have a vulnerability where the PATH_INFO is truncated at an encoded NUL byte (%00) during HTTP request parsing. This occurs because the XS parser URL-decodes the request path and uses strlen() to measure it, causing the path to end prematurely at the first decoded NUL byte. The pure-Perl backend is not affected. This discrepancy can allow a remote attacker to send a path that a proxy or filter inspects fully, while the application routes on a truncated, shorter path.
Starlet versions before 0.33 for Perl improperly send a body in responses to HEAD requests, causing corruption of subsequent responses on persistent or pipelined HTTP connections. This occurs because the request method is not passed to the response writer, resulting in unintended body content being sent. This behavior can desynchronize clients or proxies sharing the connection.
CVE-2026-119716 is a critical code injection vulnerability in the pybars3 and pybars4 Python libraries used for Handlebars templating. It affects pybars3 versions up to 0.9.7 and pybars4 versions up to 0.9.13. The flaw allows template authors to execute arbitrary Python code by supplying crafted bracketed path segments that break out of string literals in template helper or block arguments. This can lead to remote code execution within the application process without requiring authentication or user interaction.
InternLM lmdeploy versions 0.9.0 through 0.18.0 have a critical unauthenticated remote code execution vulnerability. Attackers can send specially crafted base64-encoded pickled data to the /update_weights endpoint, which is deserialized without validation, allowing execution of arbitrary OS commands as the api_server process.
CVE-2026-93327 is a critical deserialization of untrusted data vulnerability in the SubWorkflow task of Google Cloud Application Integration prior to the 2026-09-11 patch. It allows an authenticated attacker to execute arbitrary code by submitting a malicious serialized object. The vulnerability was patched on September 11, 2026, and no customer action is required as Google manages remediation for this cloud service.
CVE-2026-61738 is a critical path traversal vulnerability in socfortress CoPilot versions prior to 0.1.77. The flaw exists in the POST /api/scoutsuite/generate-gcp-report endpoint, where an unsanitized filename from a multipart upload is used to save files without proper path containment checks. This allows an attacker with admin or analyst privileges to write files outside the intended directory, potentially overwriting application source files. The vulnerability was fixed in version 0.1.77 by removing caller-controlled filenames from the affected route. The vulnerability has a CVSS score of 10.0, indicating critical severity, but there are no known exploits in the wild at this time.
ng-antd-admin versions prior to 22.0 contain a hardcoded default JWT secret key. If the default secret is not replaced during deployment, attackers can forge tokens to bypass authentication and authorization, impersonate any user including administrators, and access protected API endpoints. This leads to account takeover, data leakage, and unauthorized operations. Version 22.0 mitigates this by rejecting the default secret in production environments and issuing warnings in non-production environments.