CVE-2026-119335 is an OS command injection vulnerability in pi-hole versions prior to 6.5. The vulnerability arises from improper validation of the pihole-owned PID file, allowing an attacker with pihole user privileges to craft a malicious PID file that leads to command execution as root. This flaw bypasses previous remediation measures and is fixed in pi-hole version 6.5.
CVE-2026-62335 is an improper input validation vulnerability in openvm-org's OpenVM zkVM framework. Versions before 1.7.0 in the 1.x line, and certain prereleases of 2.0 and 2.1, allow the verify function to accept non-canonical 256-bit values for app executable and VM commitments without verifying they are less than the BN254 scalar field modulus. This can cause ambiguity between the byte-level inputs and the field elements used by the verifier. The issue is fixed in versions 1.7.0, 2.0.0-rc.3, and 2.1.0-preview.
A path traversal vulnerability (CWE-59) in pi-hole prior to version 6.5 allows an administrator with the ability to add adlists and place symlinks on the filesystem to bypass file read checks. The gravity.sh script uses curl, sometimes running as root, to normalize URLs, which can cause it to open unintended files with elevated privileges. This issue is fixed in pi-hole version 6.5.
CVE-2026-62337 is an improper input validation vulnerability in the axiom-crypto snark-verifier prior to version 0.2.5. The Halo 2 aggregation circuit mishandles proof points encoded as the point at infinity, allowing a prover-controlled proof point (0,0) to affect the multi-scalar multiplication and accumulator computation. This flaw is fixed in version 0.2.5.
CVE-2026-119333 is an untrusted search path vulnerability in draw.io Desktop (Electron build) on Windows prior to version 31.5.2. The application launched system executables powershell and attrib by bare name from its main script, allowing an attacker to place malicious executables in the current working directory. Opening a .drawio file from File Explorer in a directory containing attacker-controlled powershell.bat or attrib.exe could lead to code execution. This issue is fixed in version 31.5.2.
CVE-2026-61618 is an improper input validation vulnerability in axiom-crypto's snark-verifier prior to version 0.2.5. The issue arises because KZG accumulator public-instance limbs are decoded without enforcing canonical limb bounds before elliptic-curve coordinate reconstruction. This can lead to noncanonical encodings reaching the verifier boundary and potentially causing a crash in the native verifier. The vulnerability is fixed in version 0.2.5.
CVE-2026-119332 is a use-after-free vulnerability in LadybirdBrowser's JavaScript engine, specifically in the FinalizationRegistry cleanup process. An attacker-controlled JavaScript callback can trigger freeing of memory that is still accessed later, leading to memory corruption. This flaw can cause crashes and potentially allow code execution. The vulnerability has a high severity score of 8.8 and has been fixed in a specific commit.
HoneySQL turns Clojure data structures into SQL. From 2.0.0 until 2.7.1392, applications that pass user input or other arbitrary data into the HoneySQL `DSL` by calling `keyword` or `symbol` on that input can produce SQL strings that facilitate SQL injection when executed unchanged by a `JDBC` driver. Some formatters do not apply the existing suspicious-character check to the resulting entity names. The impact depends on the privileges of the database connection executing the generated statement. Input validation before constructing `keyword` or `symbol` entities is a workaround. The maintainer-designated fixed version is 2.7.1392.
Ladybird is a truly independent web browser. Prior to the c0d68bddf3e3616e5173835f0f4c155ee9700d91 commit, CSSStyleSheet.cssRules, insertRule(), and deleteRule() in Libraries/LibWeb/CSS/CSSStyleSheet.cpp did not enforce the stylesheet origin-clean flag with the required SecurityError, even though cross-origin imported stylesheets were correctly marked non-origin-clean. A malicious page could read parsed rules from a stylesheet loaded without CORS and could insert or delete rules in the victim stylesheet, bypassing the Same-Origin Policy. Reading could expose selectors, generated content, feature markers, or other sensitive rule text, while mutation could alter page visibility or layout. The issue does not provide memory corruption, code execution, or persistence after the attacker page closes. This vulnerability is fixed by commit c0d68bddf3e3616e5173835f0f4c155ee9700d91.
pgAdmin 4 versions before 9.19 contain an argument injection vulnerability in the materialized view refresh feature. The database name passed to the psql --dbname argument was not properly sanitized, allowing a specially crafted database name to redirect connections to arbitrary hosts and ports. This could expose the connecting user's saved server password to an attacker-controlled endpoint. The issue was fixed in version 9.19 by properly routing the database name through a helper function that ensures it is treated strictly as a database name.
pgAdmin 4 versions before 9.19 did not invalidate existing user sessions when a password was changed, allowing sessions established before the change to remain active until expiration. This could enable continued access by someone with an old password or session cookie despite the password update. The issue is fixed in version 9.19 by rotating the user's session identifier upon password change, logging out all other sessions. Saved server passwords are also re-encrypted or cleared if re-encryption fails.
CVE-2026-116250 is a time-of-check to time-of-use (TOCTOU) race condition vulnerability in pgAdmin 4 server mode prior to version 9.19. It allows an attacker with write access to the user's storage directory to exploit symbolic or hard links or FIFOs to read, write, or load files outside the intended storage directory with the privileges of the pgAdmin operating system account. Exploitation requires the ability to create such links or FIFOs in the storage directory and to win a race condition. The issue was fixed in pgAdmin 4 version 9.19 by securely opening files component-by-component with O_NOFOLLOW and passing open file descriptors to utilities.
CVE-2026-116249 is a path traversal vulnerability in pgAdmin 4 server mode prior to version 9.19. It allows an attacker to specify file paths outside the intended user storage directory, potentially accessing another user's password file, SSL certificates, keys, or SSH tunnel identity files. Additionally, crafted connection parameter names could bypass validation, enabling injection of extra parameters. The issue is fixed in version 9.19 by enforcing path confinement and strict parameter name validation.
CVE-2026-116248 is a missing authorization vulnerability in pgAdmin 4 server mode prior to version 9.19. It allows non-administrative users to create or import shared servers that appear trusted to other users, potentially tricking them into connecting to attacker-controlled hosts and exposing their database credentials. The vulnerability arises because the server API improperly accepts and stores the 'shared' flag from non-administrators, and the servers.json import only removes unauthorized shared entries after validation. The issue is fixed in pgAdmin 4 version 9.19 by rejecting unauthorized share requests and pruning shared entries from imports before validation.
CVE-2026-116247 is a vulnerability in pgAdmin 4 before version 9.19 where insufficient protection of credentials in server mode allows any user to connect using the service account's saved passwords or client certificate. This occurs when no password file, client certificate, or client key is configured or found, causing libpq to fall back to default credential files of the operating system account running pgAdmin. The issue is fixed in version 9.19 by ensuring connection parameters explicitly specify user-specific credential files or invalid paths to prevent unauthorized access.
CVE-2026-116246 is a vulnerability in pgAdmin 4 before version 9.19 where server passwords were exposed in the process environment. Passwords were stored in environment variables shared across user requests and inherited by background processes, allowing one user to access another user's saved password. This issue was fixed in version 9.19 by isolating the password environment to only the specific process that requires it.
CVE-2026-116245 is a vulnerability in pgAdmin 4 before version 9.19 where insufficient protection of credentials allows unauthorized users in server mode to connect using stored service credentials. The issue arises because libpq uses connection service entries from the operating system account running pgAdmin 4, which can include passwords or references to password files or client certificates. The vulnerability is addressed in pgAdmin 4 version 9.19 by introducing a SERVER_MODE_ALLOWED_SERVICES setting that restricts allowed services, disallows the servicefile parameter, and removes sensitive environment variables at startup.
CVE-2026-116244 is a vulnerability in pgAdmin 4 before version 9.19 where Kerberos credentials were insufficiently protected. The issue allowed any user to connect as the service account's Kerberos principal in server mode due to improper handling of Kerberos credential caches. The vulnerability was fixed in pgAdmin 4 version 9.19 by restricting credential cache usage and enforcing stricter authentication requirements.
CVE-2026-116243 is a high-severity vulnerability in pgAdmin 4 before version 9.19. It involves an untrusted search path issue where pgAdmin runs database utility binaries from user-configured paths. In server mode, the binary path validation was insufficient, allowing users to upload executables to shared storage and have pgAdmin run them with the server's operating system privileges. This is exploitable particularly on Windows servers where uploaded files can be executable. The issue is fixed in pgAdmin 4 version 9.19 by enhancing path validation and checks.
pgAdmin 4 versions before 9.19 have a vulnerability where SSH tunnels in server mode improperly use the service account's SSH keys and configuration, allowing any user to create tunnels to hosts accepting the service account's key without their own credentials. This issue is fixed in version 9.19 by restricting tunnel authentication to only the user's configured identity file or password.