CVE-2026-126326 is an improper access control vulnerability in Devolutions Server versions up to 2026.3.13.0. It allows an authenticated user with vault assignment management rights to escalate privileges and read vault entry passwords by exploiting the administrative role assignment endpoint. The issue is fixed in version 2026.3.14.
CVE-2026-126331 is a vulnerability in Devolutions Server 2026.3.13.0 and earlier where sensitive information, specifically users' API key secret hashes, is inserted into the data sent by the user list API endpoint. This allows an authenticated user with delegated user-viewing permissions to access these secret hashes. The issue is fixed in version 2026.3.14.
CVE-2026-126328 is a vulnerability in Devolutions Server versions up to 2026.3.13.0 that allows an authenticated user with delegated user-viewing permissions to access other users' MFA shared secrets via the user API responses. This occurs due to cleartext storage and transmission of sensitive information in user endpoints. The issue is fixed in version 2026.3.14.
CVE-2026-126327 is an improper access control vulnerability in Devolutions Server version 2026.3.13.0 and earlier. It allows an authenticated user without permission to view passwords to access historical entry passwords through the connection history API. The issue is fixed in version 2026.3.14.
A security regression in Lenovo XClarity Controller (XCC) versions 2.51 IHX432Y through 2.56 IHX436K reintroduces the default OpenBMC root password after performing an XCC Reset to Default operation. This allows an attacker with access to the device to use default credentials to gain administrative access to XCC interfaces and the underlying operating system, which is normally restricted. These affected versions are no longer available for download, and process improvements have been implemented to prevent similar regressions in the future.
CVE-2026-65952 is an OS command injection vulnerability in Lenovo OneCLI 5.5.0 for Linux. It arises from improper neutralization of special elements in the remote SSH operation functionality, allowing an attacker to execute arbitrary OS commands with the privileges of the configured SSH account by supplying a crafted remote path.
CVE-2026-65951 is a path traversal vulnerability in Lenovo XClarity Essentials OneCLI 5.5.0 for Linux. It affects the TAR.GZ extraction logic, allowing an attacker to write arbitrary files with the privileges of the OneCLI process by tricking a user into processing a malicious TAR.GZ update package. The vulnerability affects versions up to and including 5.6.0. The CVSS score is 5.8, indicating a medium severity level.
CVE-2026-65950 is a path traversal vulnerability in the ZIP extraction logic of Lenovo XClarity Essentials OneCLI 5.5.0 for Linux. This flaw allows an attacker to write arbitrary files with the privileges of the OneCLI process by tricking a user into processing a malicious ZIP-based update package. The vulnerability affects versions up to and including 5.6.0. The CVSS score is 5.8, indicating a medium severity level.
CVE-2026-65949 is an OS command injection vulnerability in Lenovo XClarity Integrator for Microsoft Windows Admin Center versions 5.1.1 through 5.2.0. It allows an authenticated remote attacker to execute arbitrary PowerShell commands by submitting a specially crafted hostname.
A NULL pointer dereference vulnerability exists in winshining's nginx-http-flv-module prior to version 1.2.14. This occurs when the module processes an HTTP/1.0 request without a Host header, leading to a NULL pointer dereference and potential denial of service. The issue has been fixed in version 1.2.14.
CVE-2026-125926 is a server-side request forgery (SSRF) vulnerability in the server registration and update API of Amazon mcp-gateway-registry versions 1.0.3 through 1.34.0. An authenticated remote user could exploit this flaw to send requests from the gateway to internal network services and cloud instance metadata endpoints, potentially reading the responses. This vulnerability affects versions prior to 1.35.0.
The teahy-znrpz-util npm package contains malicious code that executes hidden payloads on module load. It stores obfuscated executable logic as a compressed byte array in a non-standard package.json key, decompresses it, and runs it with full Node.js privileges. The code avoids execution in CI or sandbox environments, targeting real developer or production machines.
A missing authorization vulnerability in the external management API of Amazon mcp-gateway-registry versions 1.0.9 through 1.24.7 allows an authenticated remote user to escalate privileges. By exploiting this flaw, the attacker can assign the registry administrator scope to their own identity group, gaining administrative control over all registered gateway assets.
Laradocs versions from 0.4.0 up to but not including 1.0.0 contain a local OS command injection vulnerability in the server-side KaTeX rendering process. This occurs due to an unescaped Node.js binary path used in a proc_open() command string. The vulnerability has been fixed in version 1.0.0.
The mock-data-sdk npm package contains malicious code disguised as a mock data generator. It hides a base64-encoded JavaScript payload that is decoded and executed dynamically, evading detection. The payload loads additional modules, writes a Python script to the /tmp directory, and recursively searches the filesystem for files with names indicating sensitive information such as passwords, wallets, seeds, private keys, or environment variables. This behavior is unrelated to the package's advertised functionality and indicates malicious intent.
The npm package fcefi-wdojs-util version 1.0.0 contains malicious code that executes hidden JavaScript payloads at require-time. It reads an undeclared numeric array from its package.json, decompresses it, and runs the code via the Function constructor, bypassing CI and sandbox environments. A large opaque hex blob in a misleadingly named config file acts as a second-stage encrypted payload. This multi-stage dropper has no legitimate utility and is designed to evade detection in automated scanning environments.
ideon versions prior to 0.9.6 contain a server-side request forgery (SSRF) vulnerability due to insufficient IPv6 address validation in the safeFetch function. The vulnerability allows authenticated users to bypass SSRF protections by using IPv6 transition addresses that embed private IPv4 addresses, enabling access to internal network resources such as cloud metadata endpoints and localhost services. This flaw has been fixed in version 0.9.6.
ideon versions prior to 0.9.5 contain a missing authentication vulnerability in the link-preview endpoint, allowing anonymous users to relay arbitrary URLs to the server-side fetch function. Although a general SSRF guard exists, the endpoint is publicly accessible without login, and the SSRF filter can be bypassed to reach the server's loopback interface. This vulnerability is fixed in version 0.9.5.
CVE-2026-65968 is a server-side request forgery (SSRF) vulnerability in ideon, a self-hosted visual workspace. Versions prior to 0.9.4 improperly validate URLs in SSRF protection functions, failing to recognize certain IPv6 canonical forms of IPv4-mapped addresses. This allows an authenticated user to bypass host-blocking and cause the server to make unauthorized requests to internal resources such as loopback addresses or cloud metadata services. The issue is fixed in version 0.9.4.
A vulnerability in ideon versions prior to 0.9.4 allows users with read-only viewer roles to perform unauthorized write operations on projects. Specifically, several project mutation endpoints under /api/projects/[id]/* do not enforce role-based access control, enabling viewers to modify or delete project content. The most critical endpoint affected is POST /api/projects/[id]/graph, which can delete and rewrite the entire project canvas. This flaw contradicts the intended read-only restriction for viewers and has been fixed in version 0.9.4.