repmgr versions 4.0.0 through 5.5.0 contain an OS command injection vulnerability in event notification commands when certain placeholders (%a, %c, %d) are used without proper escaping. This allows a non-superuser database user with write access to node records to execute arbitrary OS commands as the operating system user running repmgr on other cluster nodes. The vulnerability is fixed in repmgr 5.5.1, and operators must adjust their configuration to remove quotes around placeholders after upgrading.
A vulnerability in proxygen prior to version v2026.11.09.00 allows a remote, unauthenticated HTTP/1.1 client to cause a server crash by pipelining the start of a second request and then stopping reading. This leads to the server freeing a pipelined stream incorrectly during a write timeout, potentially causing denial of service and possible memory corruption.
Kendo UI for jQuery versions from 2026.3.1015 up to, but not including, 2026.4.1110 contain a vulnerability in the Grid and TreeList components where the column-reorder drag clue reparses header text as HTML. This allows an attacker who can control a column field or title to execute JavaScript when a user drags a column header with column reordering enabled, potentially compromising data confidentiality and integrity in the user's browser.
mvfst versions prior to v2026.11.09.0 have a vulnerability where out-of-order STREAM frame data is not adequately merged or compacted. This allows a remote, unauthenticated QUIC peer to send many small, non-contiguous stream fragments, causing excessive memory consumption and increased CPU usage on the target, potentially leading to denial of service.
A vulnerability in the GNU C Library versions 2.2 through 2.44 affects the wide scanf family of functions when called with %s or %[ conversions without the 'l' length modifier. This causes an extra null byte to be written just past the end of the destination array if the converted multibyte string exactly fills the buffer. The overflow byte is always a null byte, which can corrupt adjacent memory or cause a crash. This issue affects all architectures and ABIs supported by the GNU C Library. Narrow scanf functions and other related conversions are not affected.
In Progress® Kendo® UI for jQuery versions prior to 2026.4.1111 contain a vulnerability in the kendo.init() function where data-* attribute values are compiled using new Function when invalid JSON is supplied. This allows an attacker with low privileges who can control these attributes to inject JavaScript that executes during widget initialization, potentially compromising data confidentiality and integrity in the user's browser. The issue was reported in version 2022.3.1109, but the exact first affected version is not established.
A missing authorization vulnerability in the JSON-RPC web services interface of Extreme Networks Switch Engine (EXOS) allows an authenticated low-privileged (read-only) user to execute CLI show commands beyond their intended permissions. This leads to disclosure of sensitive information such as device configuration and password hashes of local accounts. The vulnerability does not affect configuration, enable, or debug commands. Password hashes disclosed can be attacked offline, potentially allowing administrative access if weak passwords are used. The issue is fixed in specific patched versions of Switch Engine.
A critical SQL injection vulnerability in Red Hat Quay allows authenticated attackers to bypass tenant isolation in multi-tenant deployments. By creating a namespace with an underscore character, attackers exploit SQL LIKE pattern matching to access robot account tokens from other tenants. These stolen tokens enable unauthorized read, push, or overwrite operations on container images, risking container supply chain integrity especially in OpenShift environments. Red Hat has released fixed versions and already patched Quay.io. Workarounds include restricting namespace creation and rotating tokens but do not fully mitigate the flaw.
A vulnerability in GNU C Library versions 2.3 through 2.44 affects the regcomp and regexec functions, which may read freed memory and double-free heap blocks when memory allocation fails during regular expression compilation or matching. This can cause process crashes under memory pressure conditions. The issue does not require crafted regular expressions and affects all architectures supported by the library.
CVE-2026-123872 is a high-severity vulnerability in Node.js affecting versions 22.x, 24.x, and 26.x. It allows a client to bypass client certificate authentication by changing the servername during TLS 1.2 renegotiation. This enables the client to access endpoints with stricter client-certificate policies by carrying over authentication from a less restricted host. The issue is fixed in Node.js versions 22.23.5, 24.22.3, and 26.13.1.
CVE-2026-65843 is a high-severity vulnerability in ForbesLindesay's sync-rpc prior to version 1.3.7. The flaw involves missing authentication for critical functionality, allowing an attacker who can guess the correct port and bypass firewall restrictions to load and execute arbitrary JavaScript files on the server. This issue has been fixed in version 1.3.7.
Dell OpenManage Ansible Modules versions 6.0.0 through 10.0.3 contain an XML injection vulnerability due to improper neutralization of special elements in the XML data conversion component. This flaw could allow a low privileged remote attacker to inject malicious XML content, causing XML parsing errors and potentially impacting integrity and availability. The vulnerability is tracked as CVE-2026-91878 with a high severity score of 7.6. A fix is available starting from version 11.0.0.
Microsoft's November 2027 Patch Tuesday addresses a large volume of vulnerabilities totaling 1,260, including 68 critical issues. Among these are multiple critical remote code execution and elevation of privilege vulnerabilities affecting Microsoft LDAP, Queuing and Queue Manager, Windows TCP/IP stack, and various Azure services. Additionally, 167 Chromium vulnerabilities impacting Microsoft Edge are patched. One Outlook spoofing vulnerability (CVE-2026-124194) is noted as already exploited in the wild. The patches cover a broad range of Microsoft products and components.
CVE-2026-123877 is a certificate validation bypass vulnerability in Node.js https.Agent affecting versions 22.x, 24.x, and 26.x. The flaw allows a cached TLS session authenticated under a broader CA policy to be reused in a later request with a stricter CA policy, potentially causing unauthorized trust of a server that should be rejected. This occurs because https.Agent.prototype.getName() assigns the same session-cache key to requests omitting the 'ca' option and those explicitly supplying an empty 'ca' array, leading to improper session reuse. The vulnerability has a CVSS score of 6.8 (medium severity) and is fixed in Node.js versions 22.23.5, 24.22.3, and 26.13.1.
CVE-2026-119055 is a Use After Free vulnerability (CWE-416) in Schneider Electric EcoStruxure™ Power Build Rapsody. A local attacker could exploit this by tricking an end user into opening a specially crafted malicious SSD file, potentially leading to arbitrary code execution. The vulnerability requires user interaction and local access. It has a medium severity with a CVSS score of 4.6.
Icinga Web 2 versions prior to 2.12.7 and 2.13.1 contain an open redirect vulnerability (CWE-601). An attacker can craft a URL that, when visited by an authenticated user whose locale is not en_US, causes the backend to redirect the user to an arbitrary location. This vulnerability has been fixed in versions 2.12.7 and 2.13.1.
CVE-2026-123871 is an information exposure vulnerability in Node.js where proxy credentials are leaked in ERR_PROXY_INVALID_CONFIG error messages. Although a previous fix redacted credentials from ProxyConfig.href, this vulnerability affects four other error paths that still expose raw proxy URLs including credentials. These error messages can be emitted to stderr, container logs, and crash reporting services, potentially exposing sensitive proxy credentials. The issue affects Node.js versions 22.x, 24.x, and 26.x prior to specific fixed releases.
Dell OpenManage Ansible Modules versions 2.0.2 through 10.0.3 contain a vulnerability in the OData filter processing component that improperly neutralizes special elements in data query logic. This flaw could allow a low privileged remote attacker to bypass authorization, access unauthorized data, or cause denial of service. The vulnerability is tracked as CVE-2026-91877 and has a high severity rating with a CVSS score of 7.6. A fix is available starting from version 11.0.0.
CVE-2026-123868 is a vulnerability in Node.js versions 24.x and 26.x where an unauthenticated HTTP/2 client can cause uncontrolled resource consumption. The issue arises because inbound DATA frames queued on an undrained stream are not properly accounted against the session memory budget, allowing excessive memory retention. This can lead to memory exhaustion on the server side. The vulnerability has been fixed in Node.js versions 24.22.3 and 26.13.1.
A heap-buffer-over-read vulnerability exists in the chunked-transfer-encoding HTTP request parser of iopress versions prior to 1.0.5. This occurs when a request declares a chunk size larger than the actual body received, causing the parser to read past the input buffer's end. The issue has been fixed in version 1.0.5.