A Server-Side Request Forgery (SSRF) vulnerability exists in draw.io versions prior to 30.3.8 in the optional /proxy endpoint. The URL validator does not block requests to the RFC 6598 shared address range 100.64.0.0/10, allowing unauthenticated remote attackers to make the server request internal services within this range. This could lead to disclosure of data from Carrier-Grade NAT, Kubernetes, cloud, or overlay-network addresses. The issue is fixed in version 30.3.8.
CVE-2026-104203 is a vulnerability in Traccar, an open source GPS tracking system, affecting versions from 5.1 up to but not including 6.15.0. It allows an unauthenticated attacker to bypass session and device authorization checks by exploiting a path parameter parsing discrepancy between MediaFilter and Jetty ResourceServlet. This enables read-only access to protected device media files such as photographs, audio, or video. The issue is fixed in version 6.15.0.
CVE-2026-122013 is a critical path traversal vulnerability in the Comfast CF-WR632AX device version 2.6.0.1. The flaw exists in the Multipart Parser component of the /usr/bin/webmgnt file, allowing remote attackers to manipulate the filename argument to perform path traversal. Exploit code is publicly available, and the vendor has not responded to disclosure requests.
SumatraPDF versions 3.6.1 and earlier contain a vulnerability in the HttpGet() function where hostname validation is disabled for HTTPS update metadata and crash-symbol requests. This allows a network attacker with a trusted certificate for a malicious domain to impersonate the update server, inject malicious promotional content, and supply attacker-controlled archives to the symbol extraction process. Direct installer replacement is prevented by additional TLS validation and host restrictions. No fixed version is currently available.
CVE-2026-102664 is a vulnerability in ProxySQL prior to versions 3.0.10, 3.1.10, and 4.0.10. It involves improper handling of compressed MySQL payloads where the decompression function does not verify that the output length matches the attacker-controlled payload length. This can lead to the proxy forwarding uninitialized heap buffer data to the backend, potentially disclosing sensitive information such as prior SQL queries, result data, credentials, or session state. The flaw also allows malformed lengths to cause excessive memory allocations. The issue has been fixed in the specified versions.
Telepresence versions prior to 2.31.0 contain a vulnerability in the Traffic Manager gRPC API that allows unauthenticated callers within the cluster network to register in any managed namespace and create service intercepts without proper Kubernetes RBAC checks. This flaw enables an attacker with network access to the manager pod to intercept traffic and access sensitive container environment data, including secrets and tokens. The issue is fixed in version 2.31.0.
CVE-2026-122224 is a missing authorization vulnerability in the WebVirtCloud project by retspen. Due to the absence of declared permission classes in certain API views, low-privileged authenticated users can access sensitive endpoints that should be restricted. This allows them to migrate or undefine other users' virtual machines and create volumes and domains on any compute host.
Trawl versions from 1.5.0 up to but not including 1.10.0 contain a server-side request forgery (SSRF) vulnerability. This flaw allows unauthenticated attackers to bypass the outbound URL policy by using IPv4-mapped IPv6 addresses, enabling them to access internal resources such as loopback, private networks, and cloud metadata services. The vulnerability is fixed in version 1.10.0.
blueprintUE Self-Hosted Edition versions before 4.3.3 have an account enumeration vulnerability in the ForgotPasswordMiddleware.php component. This flaw allows unauthenticated attackers to determine whether an email address is registered by observing differences in password reset redirect behavior. The vulnerability is exacerbated by the lack of rate limiting on failed lookup attempts, enabling unlimited enumeration.
BlueprintUE Self-Hosted Edition versions 4.2.0 up to but not including 4.3.4 have a vulnerability in their login rate limiting mechanism. The issue arises because failed-login counters are keyed on case-sensitive usernames, while the underlying MySQL database performs case-insensitive lookups. This discrepancy allows unauthenticated attackers to bypass per-account lockout by varying the casing of usernames, enabling additional brute-force attempts on passwords.
Powerlevel10k versions before 1.20.19 contain a vulnerability in the bundled gitstatus/install script where an insecure temporary directory is reused if mktemp fails. This allows local attackers to pre-create a predictable temporary directory named gitstatus-install.tmp and replace the extracted gitstatusd binary, which then executes with the victim's privileges.
Powerlevel10k versions before 1.20.19 have a symlink following vulnerability in the _p9k_dump_instant_prompt function. This flaw allows local attackers to overwrite files writable by the victim by pre-planting symbolic links in a predictable temporary file path based on the victim's shell PID. The vulnerability is fixed in version 1.20.19.
Mistral Vibe versions prior to 3.0.3 contain a remote code execution vulnerability. This flaw allows attackers to execute arbitrary commands by manipulating repository settings related to gpg.program and log.showSignature. Exploitation occurs during project context collection when a crafted repository with a signed commit triggers git log to run the attacker's program at session start, before any trust prompt is shown. The vulnerability is fixed in version 3.0.3.
Mistral Vibe versions before 2.25.7 contain a remote code execution vulnerability. This flaw allows attackers to execute arbitrary commands by configuring malicious Git clean or process filter drivers in a repository. When a user opens such a crafted repository, the application runs 'git status' at startup, triggering the malicious filters and executing commands with the user's privileges before any trust prompt appears. This vulnerability is fixed in version 2.25.7.
Mistral Vibe versions before 2.25.5 on Windows have an untrusted search path vulnerability. This flaw allows attackers to execute arbitrary code by placing a malicious git.exe in a repository root. When a user opens a crafted repository, components SessionLogger and ProjectContextProvider run the malicious git.exe at session start without any trust prompt.
CVE-2026-122132 is an open redirect vulnerability in the go-chi chi web framework versions 5.2.2 through 5.5.0. The flaw exists in the RedirectSlashes middleware, where attackers can embed URL-encoded tab characters in request paths. Browsers strip these tabs from the 301 Location header, causing the redirect to resolve as a protocol-relative URL and allowing redirection to external, potentially untrusted hosts. This bypasses a previous fix for CVE-2025-69725.
CVE-2026-122131 is a prototype pollution vulnerability in the hapijs joi library affecting versions >=17.13.6 <17.13.9 and >=18.2.5 <18.3.1. The flaw exists in lib/messages.js within the compile() and merge() functions, which fail to reject a __proto__ language key. This allows attackers to modify the prototype of compiled messages, potentially altering or breaking validation error rendering and related logic. The issue is fixed in versions 17.13.9 and 18.3.1.
CESNET ipfixcol2 versions 2.3.0 up to but not including 2.9.0 contain an integer overflow vulnerability in the Forwarder output plugin. This flaw allows unauthenticated IPFIX exporters to overflow a heap buffer by wrapping uint16_t message length counters. Attackers can exploit this by sending near-65535-byte data sets and large templates to a collector forwarding over TCP, potentially causing a crash and enabling 2-byte writes to attacker-controlled memory addresses. The vulnerability is fixed in version 2.9.0.
CESNET ipfixcol2 versions 2.7.1 up to but not including 2.9.0 contain a memory allocation vulnerability in the Lz4Decoder::read_start_header() function. This flaw allows unauthenticated attackers to cause excessive memory allocation by sending LZ4 start headers with very large buffer sizes, potentially exhausting up to 4 GiB of memory per TCP connection. The issue can lead to denial of service by exhausting collector service resources. The vulnerability is fixed in version 2.9.0.
CESNET ipfixcol2 versions 2.7.1 up to but not including 2.9.0 contain a heap-based buffer overflow vulnerability in the Lz4Decoder.cpp component. This flaw allows unauthenticated network peers to write beyond allocated heap buffers by manipulating buffer size parameters, potentially crashing the collector or causing other memory corruption issues. The vulnerability is fixed in version 2.9.0.