CVE-2026-126784 is a resource allocation vulnerability in Lagarto Chivato versions 0.1.0 through 0.4.1. The publicar_aviso RPC function lacks rate limiting, per-account submission quotas, and geographic validation, allowing remote authenticated users to flood the moderation queue with unlimited notice submissions containing arbitrary coordinates. This can lead to denial of service by exhausting moderation resources.
AsiaInfo BSS Platform versions 9.2.0 up to but not including 9.2.38 contain a stored cross-site scripting (XSS) vulnerability in the menu icon upload function. Authenticated users with ordinary privileges can upload SVG files with embedded JavaScript. While normal menu rendering does not execute this script, exploitation occurs if a victim loads the SVG directly as a document, allowing script execution under the application origin.
A denial of service vulnerability via use-after-free exists in the gcc compiler's binary heap erase_if function, identified as CVE-2026-102010. This affects gcc-toolset-15-gcc and gcc-toolset-16-gcc packages. Red Hat has issued a security advisory for this moderate severity issue and provides updated packages for Red Hat Enterprise Linux 10.2 Extended Update Support and related products.
A denial of service vulnerability (CVE-2026-19248) exists in the XML parsing component of the Qt6 base toolkit (qt6-qtbase). This issue affects Red Hat Enterprise Linux 10.2 Extended Update Support and related CodeReady Linux Builder products. The vulnerability is rated as having moderate security impact by Red Hat. A security update is available that addresses this flaw.
A use-after-free vulnerability (CVE-2026-125704) exists in the GStreamer core buffer value deserialization component of the gstreamer1 streaming media framework. This flaw affects Red Hat Enterprise Linux 8 and its variants. The vulnerability is rated with high severity by Red Hat Product Security. An update addressing this issue is available for affected Red Hat Enterprise Linux 8 packages.
The egOS system trust store in Welotec EG500 devices includes eMudhra emSign root certificates linked to eight compromised intermediate certificate authority keys. An attacker with one of these compromised keys who can intercept network traffic may issue fraudulent TLS certificates, impersonate remote services, and read or modify TLS traffic from the device.
A denial of service vulnerability (CVE-2026-102554) exists in Google Guava due to unthrottled memory allocation during deserialization. This flaw can cause excessive memory consumption leading to service disruption. Red Hat has issued an important security update for Guava in Red Hat Enterprise Linux 10.2 Extended Update Support and related products to address this issue.
A denial of service vulnerability (CVE-2026-78667) exists in the golang net/http package used by the containernetworking-plugins in Red Hat Enterprise Linux 9.8 Extended Update Support. The flaw involves crafted HTTP Range headers that can cause service disruption. Red Hat has issued a security update to address this issue in containernetworking-plugins version 1.9.0-5.el9_8.
The aurum-pay Python package version 1.2.0 contains a remote-command backdoor that executes arbitrary commands fetched from a remote server. On the first API call, the package silently downloads and runs shell commands on the host system, enabling full remote code execution. This behavior is concealed by running commands in hidden or backgrounded processes with output suppressed. The payload establishes persistence and allows remote control, making this package a malicious threat.
CVE-2026-126781 is a vulnerability in Webmin up to version 2.670 that allows authenticated users to inject lines into a users file via unvalidated certificate DN fields containing newline characters. By ending a DN field with a backslash and newline, an attacker can add a root entry with a known password hash, potentially gaining root access after the miniserv service restarts.
CVE-2026-126780 is a privilege escalation vulnerability in Webmin versions up to 2.670. It affects the acl/save_group.cgi component, allowing delegated administrators to escalate privileges by submitting arbitrary module lists. Attackers with access to the Webmin Users module can assign themselves to groups with powerful modules like Command Shell, enabling root command execution.
CVE-2026-126779 is a local file read vulnerability in Spatie Browsershot versions 2.2.0 up to but not including 5.5.0. The flaw allows attackers to supply root-relative paths in HTML passed to the setHtml() function, causing the software to read and embed local server files into generated PDFs or screenshots. This occurs because elements such as iframe, img, link, or script referencing paths like /etc/passwd are resolved as file:// URLs, exposing sensitive file contents.
Wallos versions 4.4.0 up to but not including 5.10.3 contain a stored cross-site scripting (XSS) vulnerability in the sendnotifications.php endpoint. This flaw allows registered users to inject malicious JavaScript via unescaped notification service responses. An attacker can exploit this by directing a Mattermost webhook URL or Web Push endpoint to a server they control, causing script execution in an administrator's session when the vulnerable page is accessed. The vulnerability is fixed in version 5.10.3.
Traccar versions from 3.15 up to but not including 6.17.0 have an authentication bypass vulnerability in the LDAP authentication mechanism. The LdapProvider.login() method does not reject empty passwords, allowing unauthenticated LDAP binds when LDAP authentication is enabled. Attackers who know a valid username can log in without a password via API or HTTP Basic authentication if the LDAP directory permits unauthenticated binds, potentially gaining access to any account, including administrators. This vulnerability is fixed in version 6.17.0.
SiYuan versions 3.7.0 up to but not including 3.8.10 on Windows contain a path traversal vulnerability in the webfetch component. This flaw allows attackers to write files outside the intended import directory by using backslash-encoded sequences in URLs fetched by certain tools. The vulnerability is fixed in version 3.8.10.
A Cross-Site Request Forgery (CSRF) vulnerability exists in python-social-auth's social-auth-core versions 4.7.0 through before 7.0.0 in the SAML backend. This flaw allows an attacker to craft a malicious IdP response and RelayState that, when delivered to a victim's browser, signs the victim into the attacker's account, potentially capturing data entered by the victim. The issue is fixed in version 7.0.0.
@tinacms/mdx versions before 2.4.2 have a code injection vulnerability in the MDX serializer. Authenticated content editors can inject crafted values that are not properly escaped, allowing execution of arbitrary JavaScript in visitors' browsers or during build and server-side rendering.
A flaw was found in the xfs_admin utility in xfsprogs. The tool does not properly validate user-supplied parameters, allowing operating system command injection. A local attacker can exploit this issue by providing crafted input arguments, which may result in arbitrary command execution and local privilege escalation depending on how xfs_admin is executed.
CVE-2026-91150 is a denial of service vulnerability in the Cockpit cockpit-ws service on Red Hat Enterprise Linux 10. It allows an unauthenticated remote attacker to send specially crafted fragmented WebSocket messages that accumulate without size limits, causing unbounded memory exhaustion and service disruption.
CVE-2026-126051 is a high-severity vulnerability in Node.js versions 24.x and 26.x involving a NULL pointer dereference during TLS server handshake. It occurs when certain OpenSSL callbacks are deferred but the underlying socket is destroyed before the callback executes, causing the Node.js process to terminate unexpectedly. This can be triggered remotely by an unauthenticated attacker sending a crafted client hello message. Fixed versions are 24.22.3 and 26.13.1.