CVE-2026-105144 is a path traversal vulnerability in the Drogon web framework affecting versions 1.9.13-1 and 10.0-beta.0 through 10.0-beta.3 on Windows. The flaw exists in the StaticFileRouter::route function, allowing remote attackers to manipulate file paths. Exploit code has been published, but there is no vendor response or patch available as of the disclosure date. The vulnerability has a medium severity rating with a CVSS 4.0 base score of 6.9.
CVE-2026-88779 is a high-severity memory overflow vulnerability affecting NetScaler ADC and NetScaler Gateway products. The flaw exists in versions prior to 14.1-73.41 and 13.1-64.28 (including specific FIPS and earlier builds). Exploitation can lead to denial of service without requiring authentication or user interaction. The vulnerability has been publicly disclosed and is known to be exploited in the wild. Fixed versions are available.
An authorization bypass vulnerability exists in Ultimate Member up to version 2.13.1, allowing privilege escalation via a user-controlled key. This flaw enables attackers with limited privileges to escalate their access rights. The vulnerability is tracked as CVE-2026-96451 and has a high severity rating with a CVSS score of 8.8.
Nezha Dashboard versions from 1.8.0 up to but not including 2.3.13 have an improper locking vulnerability. This flaw involves a non-deferred mutex unlock that leaks on a nil-map panic path. An authenticated non-admin user can exploit this by issuing four notification API calls, causing a permanent deadlock in the alerting subsystem and subsequently exhausting memory with blocking requests. The vulnerability has a CVSS 4.0 score of 7.1, indicating high severity.
Nezha versions from 1.8.0 up to but not including 2.3.13 contain a race condition due to a lock-order inversion in the UpdateGroup and DeleteGroup functions. This flaw allows authenticated non-admin users to cause a deadlock in the alerting subsystem by concurrently invoking notification-group and batch-delete endpoints with oversized ID lists. The deadlock can permanently disrupt alert delivery until the system is restarted.
CVE-2026-71883 is a vulnerability in Legion of the Bouncy Castle Inc.'s BC-LTS-JAVA library versions from 2.73.4 up to but not including 2.73.13. The issue involves native packet ciphers for AES modes where the JNI ReleaseByteArrayElements function was called in a way that could cause the caller's cryptographic key to overwrite ciphertext when encrypting in place. This leads to exposure of the raw AES key instead of the expected ciphertext, potentially leaking sensitive key material. The flaw was fixed in version 2.73.13 by changing the release mode to JNI_ABORT for read-only input arrays, preventing the native copy from being committed back to the Java array.
CVE-2026-71888 is a high-severity vulnerability in Bouncy Castle for Java before version 1.86 and certain LTS and FIPS releases. The issue arises from improper validation of the integrity check value in the streaming CMS AuthenticatedData parser, where a mismatch between digestAlgorithm and authAttrs fields could allow an attacker to insert unauthenticated attributes into a message. This could lead to applications acting on attacker-controlled attributes without the attacker having the encryption or MAC keys. The vulnerability has been fixed in versions 1.86, 2.73.13, 2.1.13, 2.0.13, 1.0.13, 2.1.8, and 2.0.8.
CVE-2026-71889 is a vulnerability in Bouncy Castle for Java before version 1.86 and certain LTS and FIPS releases, where improper certificate validation occurs due to failure to apply X.509 name constraints to the end-entity certificate. This flaw allows a certificate chain with a leaf certificate violating the NameConstraints extension imposed by its issuing CA to be incorrectly validated as trusted by the PKIXCertPathReviewer classes. The issue has been fixed in versions 1.86, 2.73.13, 2.1.13, 2.0.13, and 1.0.13.
CVE-2026-71892 is a vulnerability in Bouncy Castle for Java before version 1.86 and certain FIPS versions where the key-size validation for CMS key-transport recipients using RFC 9709 content-encryption key derivation (id-alg-cek-hkdf-sha256) was bypassed. The validation logic incorrectly compared incompatible data types, causing the key size check to be skipped entirely for these messages. This allowed acceptance of keys with mismatched sizes despite validation being enabled. The issue affects BC-JAVA versions >=1.78 <1.86 and FIPS versions >=2.0.7 <2.0.13 and >=2.1.0 <2.1.13. The flaw is fixed in versions 1.86, 2.0.13, and 2.1.13.
CVE-2026-85515 is a vulnerability in Bouncy Castle for Java before version 1.86 and certain LTS and FIPS editions that causes improper validation of integrity check values in OpenPGP encrypted messages. Specifically, truncated encrypted messages may be accepted without error, and on some code paths, no integrity check is performed at all, allowing altered ciphertext to be accepted as valid plaintext. This affects the SEIPD version 1 path more severely, where no integrity verification occurs, and the AEAD path where truncated chunks may be silently dropped without error. The issue has been fixed in versions 1.86, 2.73.13, 1.0.14, 2.0.14.1, and 2.1.14.
CVE-2026-97873 is a vulnerability in Bouncy Castle for Java before versions 1.86 and 2.73.13. It involves the legacy PBES1 and PKCS#12 password-based encryption (PBE) schemes running key derivation with an iteration count taken from untrusted input without proper limits. This allows an attacker to specify an arbitrary amount of computational work, potentially causing resource exhaustion. The issue is addressed by bounding the iteration count with a configurable maximum and rejecting out-of-range values.
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to view privacy-restricted member profile field values — including fields explicitly configured as owner-only, members-only, or role-restricted — by querying the publicly accessible wp_ajax_nopriv_um_get_members endpoint. The nonce required by the endpoint ('um-frontend-nonce') is emitted to all unauthenticated visitors via wp_localize_script, meaning it provides no meaningful access control and any anonymous visitor can satisfy the endpoint's authentication requirements.
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'form_id' parameter in all versions up to, and including, 2.13.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The injected payload is stored in the registering user's 'submitted' usermeta via update_user_meta() and is only triggered when an administrator opens the affected user record in the wp-admin Users modal, which inserts the unescaped output via jQuery .html().
ImageMagick versions prior to 7.1.2-32 and 6.9.13-57 contain a policy bypass vulnerability in the LoadPolicyCache function. This vulnerability arises when the policy.xml file uses an alternate DOCTYPE, causing the parser to skip applying security policy rules. This allows restricted operations to be performed that should otherwise be blocked. The vulnerability has a medium severity rating with a CVSS score of 4.2.