CVE-2026-116243 is a high-severity vulnerability in pgAdmin 4 before version 9.19. It involves an untrusted search path issue where pgAdmin runs database utility binaries from user-configured paths. In server mode, the binary path validation was insufficient, allowing users to upload executables to shared storage and have pgAdmin run them with the server's operating system privileges. This is exploitable particularly on Windows servers where uploaded files can be executable. The issue is fixed in pgAdmin 4 version 9.19 by enhancing path validation and checks.
pgAdmin 4 versions before 9.19 have a vulnerability where SSH tunnels in server mode improperly use the service account's SSH keys and configuration, allowing any user to create tunnels to hosts accepting the service account's key without their own credentials. This issue is fixed in version 9.19 by restricting tunnel authentication to only the user's configured identity file or password.
CVE-2026-116241 is a critical OS command injection vulnerability in pgAdmin 4 versions before 9.19. It arises from improper handling of backslashes inside double-quoted identifiers in the Import/Export Data tool's query export feature. This flaw allows an attacker with non-administrative database role permissions to execute arbitrary OS commands on the host running pgAdmin by exploiting a discrepancy in how pgAdmin and psql parse quoted strings when standard_conforming_strings is turned off. The issue bypasses a previous fix and is resolved in pgAdmin 4 version 9.19.
CVE-2026-116240 is a path traversal vulnerability in pgAdmin 4 server mode before version 9.19. The issue arises because the path validation function check_access_permission() and the actual file operations use differently constructed paths, allowing attackers to access or manipulate files outside the intended user storage directory. This affects operations such as opening files in the Query Tool, listing folders, downloading, deleting, renaming files, and creating folders. The vulnerability does not affect desktop mode. It has a CVSS 3.1 score of 6.5 (medium severity).
CVE-2026-116239 is an improper authentication vulnerability in pgAdmin 4 server mode before version 9.19. It allows an LDAP or Kerberos authenticated user to be logged in as a different account if usernames overlap across authentication sources, potentially gaining access to another user's roles, servers, and saved database passwords. The flaw arises because pgAdmin selects the account to log in by username alone or by the login form's lookup without verifying the authentication source. This issue does not affect desktop mode and requires valid LDAP or Kerberos credentials to exploit.
CVE-2026-116238 is a vulnerability in pgAdmin 4 server mode before version 9.19 that allows bypassing the limit on failed login attempts for internal accounts. This flaw enables an unauthenticated attacker to make unlimited password guesses against internal accounts, including administrator accounts, due to improper handling of authentication attempts and password reset processes. The issue arises from the coexistence of Flask-Security views and pgAdmin's own authentication logic, case-insensitive username matching, and interactions with other authentication sources like LDAP and Kerberos. The vulnerability does not affect desktop mode and has been fixed in version 9.19.
CVE-2026-61694 is an integer overflow vulnerability in the LeJamon go-xrpl library, a Go implementation of the XRP Ledger protocol. The flaw occurs in the function ParseMPTAmountBinary, which converts an eight-byte magnitude to int64 without checking for overflow, causing large positive values to wrap into negative numbers silently. This leads to incorrect escrow amount calculations and divergence from the reference rippled implementation. Another related internal decoder accepts over-limit magnitudes without enforcing 64-bit signed integer limits, creating inconsistencies. A source code fix is available in a specific commit.
Immich versions prior to 3.2.0 contain an improper authorization vulnerability in the shared-link creation API. An authenticated attacker who knows a victim's asset UUID could create a shared link that exposes the victim's asset without proper authorization. This results in unauthorized access to victim metadata, thumbnails, and original files through an anonymous shared link. The issue is fixed in version 3.2.0.
Immich versions prior to 3.0.0 contain an authorization bypass vulnerability allowing view-only partners to enumerate GPS coordinates and existence of archived photos or videos shared by others. This exposure is limited to location metadata and asset identifiers; the actual image data remains protected. The issue is resolved in version 3.0.0.
Immich versions prior to 3.3.0 contain a path traversal vulnerability in the unauthenticated /predict endpoint of the machine-learning component. This flaw allows an attacker with network access to specify an arbitrary writable path for cache_dir, potentially leading to deletion of attacker-selected directories or modification of files via clear_cache() after model-loading failures. The vulnerability is mitigated by a model-name allowlist that prevents arbitrary model deserialization or code execution. The issue is fixed in version 3.3.0.
In Secret Server versions earlier than 12.3.1, a user could bypass the initial login step and authenticate by successfully negotiating the second factor login step only.
In Secret Server versions earlier than 12.3.1, a user under certain conditions could submit an unsigned JWT and receive cloudadmin permissions in response.
A critical improper privilege management vulnerability (CWE-269) exists in akuity kargo versions from 0.6.0 up to but not including 1.8.14, 1.9.9, and 1.10.8. Authenticated users with delegated permission to manage a Project's Roles or ServiceAccounts can escalate their privileges beyond their own permissions. This allows escalation to Project-administrator access, disclosure of Project secrets and credentials, and modification or deletion of Project resources. Exploitation requires an administrator-created custom role granting relevant permissions and control of an account assigned that role. The issue is fixed in versions 1.8.14, 1.9.9, and 1.10.8.
PinePods versions prior to 0.9.0 contain a server-side request forgery (SSRF) vulnerability that allows authenticated low-privilege users to make the server perform HTTP GET and HEAD requests to arbitrary internal and external URLs. This occurs because the application does not validate or restrict URLs in podcast RSS feed enclosures, enabling attackers to access internal services, including cloud metadata endpoints. The vulnerability is fixed in version 0.9.0.
MyTube is a self-hosted downloader and player for several video websites. Prior to version 1.10.3, `server.ts` calls `registerStaticRoutes` and `registerCloudRoutes` before `registerApiRoutes`, where `authMiddleware` and `roleBasedAuthMiddleware` are mounted. Because Express processes middleware in registration order, `staticRoutes.ts` and `cloudRoutes.ts` remain outside the authentication stack even when `loginEnabled=true`. Unauthenticated clients can access local videos through `/videos/*`, thumbnails through `/images/*` and `/images-small/*`, avatars through `/avatars/*`, subtitles through `/subtitles/*`, cloud thumbnail caches through `/api/cloud/thumbnail-cache/*`, and cloud signed URLs or redirects through `/cloud/videos/:filename` and `/cloud/images/:filename`. The frontend login wall does not protect direct media requests. Cloud routes return 404 when cloud storage is unconfigured, but that is not an authentication rejection; protected API routes correctly return 401. Combined with hidden-video path leaks, the flaw permits unauthenticated downloads of hidden media. Default loginEnabled=false single-user deployments have no authentication boundary to bypass. This issue is fixed in version 1.10.3.
CVE-2026-62301 is a missing authorization vulnerability in franklioxygen MyTube versions prior to 1.10.3. When login is enabled with a visitor password configured, the backend does not enforce the intended public-only restriction for visitor roles. This allows unauthenticated visitors to enumerate and access hidden videos and media files that should be restricted. The issue is fixed in version 1.10.3.
CVE-2026-55493 is an authorization vulnerability in HotCRP conference review software versions 2.101 up to but not including 3.3. The flaw allows an authenticated user with search access to infer the identity of authors of anonymous comments by exploiting the 'cmt:USER' search term, which fails to properly check whether the commenter's identity should be visible. This compromises reviewer anonymity. The issue is fixed in version 3.3.
Multiple critical security vulnerabilities have been identified in the python-pillow library used in Red Hat Enterprise Linux 8. These include heap buffer overflows in TIFF saving and FlashPix JPEG decoding, as well as an argument injection vulnerability in Ghostscript calls that could lead to remote code execution. Red Hat has issued a security advisory with updates to address these issues.
OSAC operator is a Kubernetes operator. In the affected revision identified as 8220502, the `console-proxy` `RemoteConfigResolver` parses Kubernetes Secret kubeconfig data with `clientcmd.RESTConfigFromKubeConfig` without sanitizing the resulting `rest.Config`. An attacker who can create or modify a Secret labeled `osac.openshift.io/remote-cluster-kubeconfig`: "true" in a namespace where the proxy's RoleBinding grants Secret read access can supply `users[].user.exec`. When `rest.TransportFor` builds the HTTP transport for an upstream WebSocket connection, client-go invokes that exec credential plugin, spawning an arbitrary process as the osac-`console-proxy` service account inside the pod. Attacker-controlled `clusters[].server` also enables server-side request forgery from the proxy pod. Remote and auto VM cluster modes are affected, with auto the default; exclusively `local` mode does not read kubeconfig Secrets and is unaffected. The credential-plugin execution path is patched in commit 7e4222b; that patch does not address the described server-address SSRF path.