CVE-2026-62990 is a high-severity cross-site scripting (XSS) vulnerability in the Shopper headless e-commerce admin panel. Authenticated back-office staff with content-upload permissions can upload executable media files, including SVG and HTML, which execute scripts in the administrator's session when opened. This can lead to unauthorized creation of attacker-controlled administrator accounts with full access to sensitive data and management functions. The vulnerability affects versions from 2.0.0 prior to 2.10.1 and prerelease versions 3.0.0-beta.1 and beta.2. It is fixed in versions 2.10.1 and 3.0.0-beta.3.
CVE-2026-62989 is an improper authorization vulnerability in shopperlabs shopper versions prior to 2.10.0. It allows authenticated staff users with edit_products permission but without delete_product_variants permission to delete product variants permanently via the Variants Livewire component. This can disrupt the storefront by destroying sellable product variants, affecting product pages, cart, and checkout functionality. The issue is fixed in version 2.10.0.
CVE-2026-59993 is a vulnerability in the picotls TLS protocol library used as a client-side TLS stack. A specially crafted sequence involving a HelloRetryRequest followed by a spoofed Hello message can trigger a null-pointer dereference, causing the affected process to terminate and resulting in denial of service. The issue is fixed in a later commit.
CVE-2026-62297 is a high-severity vulnerability in the ag-psd JavaScript library used for reading and writing Photoshop Document files. Prior to version 31.0.0, the readPsd() function allocates memory buffers based on attacker-controlled PSD geometry declarations without sufficient validation, potentially causing excessive memory allocation. This can lead to denial of service by exhausting system memory or crashing the process. Version 31.0.0 introduces a composite-image allocation limit to mitigate this issue, though some allocation paths may still require review.
jack lets users share media libraries through their Radarr/Sonarr stack, peer-to-peer. Prior to 0.1.0, `middleware/handle-error.ts` serializes raw `FetchError` objects into HTTP responses. `lib/servers/base.ts` attaches outbound request headers on upstream non-success responses and schema-validation failures; the public `extras` field in `lib/errors/FetchError.ts` remains enumerable and is emitted by JSON serialization. These headers include the internal Radarr/Sonarr `X-Api-Key` and custom connector headers such as `CF-Access-Client-Secret`. `lib/redact.ts` redacts logs and spans but not this response path. Any client with the shared peer API key, plus Cloudflare Access credentials if required by the deployment, can force an error without a race or user interaction. `GET /peer/items/:id` and `GET /servers/health` can expose the internal media-server key, while `GET /torznab/download/:id` can expose another peer's key and Cloudflare Access secrets. The /peer/search and /items routes catch these errors and are not affected. Disclosed internal keys grant full administrative control of the corresponding Radarr/Sonarr instance, crossing the intended boundary between friends' shared peer access and private backend credentials. This issue is fixed in version 0.1.0.
CVE-2026-62967 is a missing authorization vulnerability in sinamics ztnet versions prior to 0.8.0. It allows any authenticated low-privilege user to deactivate another user's account, including administrators, by exploiting an API endpoint that does not properly verify user permissions. This can result in denial of access and disruption of organization management. The issue is fixed in version 0.8.0.
CVE-2026-62966 is a NULL pointer dereference vulnerability in the ESPAsyncWebServer library prior to version 3.11.2. It occurs in the multipart parser when handling file uploads or web-OTA endpoints, causing a device reboot due to a StoreProhibited exception on ESP32 devices. This results in a remote denial of service condition. The issue is fixed in version 3.11.2.
CVE-2026-62965 is a path traversal vulnerability in SABnzbd versions prior to 5.1.0Beta3. It allows an attacker with a valid API key to delete arbitrary files or directories writable by the SABnzbd process by exploiting insufficient path validation in orphan-job management API endpoints. The vulnerability is fixed in version 5.1.0Beta3.
CVE-2026-62958 is a high-severity vulnerability in libriscv, a RISC-V sandbox and emulator, affecting versions prior to 1.18. It involves improper input validation of ELF binaries, where crafted binaries can cause out-of-bounds reads in the host emulator. This occurs because certain section-header offsets are not properly verified against the binary size, allowing access outside the intended memory buffer. The flaw can lead to host crashes (SIGSEGV) and potentially expose host memory to the guest environment. The issue is fixed in libriscv version 1.18.
Dream Displays provides in-game screens for streaming videos in Minecraft. From 1.5.0 until 1.8.2, user-controlled input can influence arguments passed to `yt-dlp` under specific conditions. Unintended command-line options may be interpreted by `yt-dlp`, potentially altering its behavior. This issue is fixed in version 1.8.2.
Picsou-finance version prior to 1.0.8 contains a timing discrepancy vulnerability in its login endpoint that allows an attacker to determine valid usernames by measuring response times. The login implementation throws an exception immediately for unknown usernames but performs a bcrypt password comparison for existing usernames, causing observable timing differences. This vulnerability does not expose or modify account data directly but can facilitate username enumeration, aiding credential stuffing or brute-force attacks. The issue is fixed in version 1.0.8.
CVE-2026-54610 is a low-severity vulnerability in LibreDWG's libredwg library prior to version 0.14. The function bit_TV_to_utf8() can write to a caller-provided input buffer marked as const, potentially modifying immutable data or causing a segmentation fault and denial of service. This occurs on certain iconv() errors when the input buffer is read-only or immutable. The issue is fixed in version 0.14.
LibreDWG is a free C library to read and write DWG files. Prior to 0.14.8413, a crafted pre-R13 DWG can make `decode_preR13_entities()` in `src/decode.c` enter a nonterminating loop that allocates a new object each iteration. `decode_preR13` in `src/decode_r11.c` computes `size` from the raw file-controlled `entities_start` and `entities_end` header bounds; the callee clamps `end` to `dat->size` but never recalculates `size`. At `end` of input, `bit_read_RC` and `bit_read_RS` stop advancing `dat->byte`, the overflow guard fails because `end` equals `dat->size`, and the no-advance check compares against `oldpos` saved before the loop instead of the previous iteration. This leaves repeated allocation of `dwg->object` entries until allocation fails or the process is OOM-killed, not merely a constant-memory CPU hang. The defect remains after the clamping and no-progress changes associated with the earlier issue 1131. Applications and tools calling `dwg_read_file()` on untrusted files, including `dwg2dxf`, `dwgread` and `dwg2svg`, can suffer denial of service when a user or automated pipeline opens a malformed file; no attacker credentials are required. This issue is fixed in repository nightly version 0.14.8413.
LibreDWG is a free C library to read and write DWG files. Prior to 0.14, a specially crafted R13-R2000 DWG can trigger algorithmic resource exhaustion in `decode_R13_R2000` in `src/decode.c`. The class-decoding loop performs `realloc` on every iteration without a sanity check on `num_classes`. Manipulating that field forces an extremely slow allocation loop and denial of service when the file is parsed. Running the parser in a sandbox with memory limits is a workaround rather than a remediation. This issue is fixed in version 0.14.
CVE-2026-62864 is a vulnerability in the ring-clojure web application library prior to version 1.15.5. The issue lies in the wrap-nested-params middleware, which uses a backtracking regular expression to parse parameter names from URL query strings and HTTP request bodies. An attacker can craft malicious parameter names that cause quadratic time complexity in regex matching, leading to a denial of service. This affects applications using the middleware, including those using Ring-Defaults where nested-params is enabled by default. The vulnerability is fixed in version 1.15.5.
CVE-2026-62863 affects the gojue moling MCP server prior to version 0.5.0. When running in SSE mode with the `-l` option, the server's `/sse` and `/message` HTTP endpoints do not authenticate requests, and the mcp-go dependency sets a permissive CORS policy allowing all origins. This allows a malicious web page to open a cross-origin EventSource to `/sse` and read sensitive sessionId information. An attacker can then use the stolen sessionId to send unauthorized MCP tool calls to `/message`, potentially reading or writing local files, executing commands, or performing other actions. The issue is fixed in version 0.5.0.
CVE-2026-119343 is a vulnerability in Stirling-PDF versions prior to 3.0.0 where an API endpoint accepts attacker-controlled HTML content without proper sanitization. This allows server-side requests to internal or cloud metadata resources and embedding of local files into generated PDFs. The vulnerable endpoint is accessible without credentials if security.enableLogin is disabled. The issue is fixed in version 3.0.0.
NovumOS versions prior to 0.25-beta.1 contain a vulnerability where the Nova interpreter runs with kernel-level privileges (Ring 0) without proper isolation. This allows a local user to execute malicious .nv scripts with unrestricted kernel memory access, bypassing security checks. The issue is fixed in version 0.25-beta.1.
ThingLinks is an enterprise IoT platform. Prior to 1.4.0, an unauthenticated SQL injection vulnerability in the `TDengine TDS APIs` allows request-controlled JSON field values submitted to `/anyUser/tds/insertTableData` to reach unsafe SQL construction in the `TDS mapper`. A remote unauthenticated attacker can tamper with TDengine time-series data, including inserting unintended rows or overwriting existing readings. The affected surface is the TDS module's insert-table-data flow and TDengine mapper SQL generation. This issue is fixed in version 1.4.0.
CVE-2026-119342 is an improper input validation vulnerability in Stirling-PDF versions 2.13.1 up to but not including 2.13.2. The flaw exists in the POST /api/v1/convert/svg/pdf endpoint, which renders attacker-supplied SVG content using Apache Batik. A scheme-less root-relative image reference bypasses the SVG sanitizer, allowing local file disclosure of image-decodable files on the server. This can occur without authentication on login-disabled deployments or with non-admin access when login is enabled. The vulnerability discloses PNG, JPG, GIF, or SVG content but does not disclose plain text, binary files, directories, or external HTTP references. The issue is fixed in version 2.13.2.