A vulnerability in git-apply(1) allows an out-of-bounds read that can crash the process when a binary patch inflates to a very large size. This flaw is identified as CVE-2026-114469 and has a medium severity rating with a CVSS score of 4.4. The issue does not have any known exploits in the wild and no specific affected versions or patches have been provided.
A vulnerability in certain versions of Octopus Server with LDAP authentication enabled allows incorrect validation of external identities during user registration. This flaw can cause a newly registered user to inherit LDAP-mapped team memberships and permissions of another user, potentially leading to unauthorized access. The issue affects only instances where LDAP groups are mapped to Octopus teams.
CVE-2026-120869 is a critical vulnerability in the Citrix NetScaler Console appliance that allows an unauthenticated attacker to bypass authentication controls and access restricted resources. This flaw enables unauthorized access without requiring user interaction or privileges. The vulnerability has a high CVSS 4.0 score of 9.3, indicating severe impact. No affected versions or patch information are provided in the available data.
A vulnerability in certain versions of Octopus Server allows users to bypass restrictions on self-service LDAP identity editing. This flaw enables users to modify their LDAP identity even when administrators have disabled such edits, potentially granting unauthorized access to teams mapped to external LDAP groups. If any of these teams have administrative privileges, the user could escalate their privileges to full administrative level.
The Gutenverse Form plugin for WordPress versions prior to 3.2.2 contains a CSV formula injection vulnerability. This flaw allows unauthenticated attackers to inject malicious spreadsheet formulas via free-text fields submitted to the public form-submit REST route. The input sanitization does not remove formula-trigger characters such as =, +, @, or a leading minus. These malicious formulas are stored and later exported in CSV files without proper neutralization, leading to formula execution when the exported file is opened by an administrator. This can result in data exfiltration or command execution on the administrator's workstation.
A vulnerability exists in the git-fast-import(1) and git-fast-export(1) features where arbitrary data can be read or written because these features are not marked as unsafe. This issue could allow an attacker with local access to read or write data unexpectedly.
CVE-2026-107484 is a vulnerability in Gaia Portal backend handlers where insufficient input and authorization validation allows an authenticated, non-administrative user to perform privileged operations reserved for administrators. This flaw could lead to unauthorized privilege escalation within the system.
Zohocorp ManageEngine DDI Central versions below 6301 contain an authorization bypass vulnerability. This flaw allows authenticated users without administrative privileges to modify DHCP options on subnets that belong to clusters they are not authorized to manage.
A vulnerability in braindecode up to version 1.8.1 affects the resolve_type_kwargs function in the Model Config Deserialization component. This flaw allows an attacker to manipulate the Activation argument, leading to the use of externally-controlled input to select classes or code. The vulnerability can be exploited remotely and public exploit details are available. Upgrading to braindecode version 2.0.0 addresses this issue.
PapaParse versions before 5.7.1 have an inefficient algorithmic complexity vulnerability that allows remote unauthenticated attackers to cause denial of service. This occurs when attackers submit delimiter-free quoted CSV input to the Papa.parse() function, triggering repeated full-buffer scans that grow quadratically with input size. The result is CPU exhaustion and blocking of the Node.js event loop or freezing of browser tabs.
Zohocorp ManageEngine DDI Central versions below 6301 contain an authentication bypass vulnerability in the Windows DNS and DHCP agent synchronization APIs. This flaw allows an unauthenticated attacker to impersonate onboarded Windows servers and perform unauthorized modifications to DNS and DHCP configurations. The vulnerability has a high CVSS score of 9.1, indicating critical severity with high impact on integrity and availability.
Backup Migration plugin for WordPress versions before 2.1.8 contains a path traversal vulnerability in its PclZip restore fallback mechanism. This flaw allows an attacker to craft a malicious zip archive with directory traversal sequences that bypass extraction restrictions when the PHP zip extension is not present. If an administrator restores such a malicious backup, arbitrary files, including PHP scripts, can be written outside the intended directory, potentially enabling remote code execution.
BookStack versions before 26.09.3 have a missing authorization vulnerability in the ImageController::checkImagePermission() function. This flaw allows authenticated non-admin users to bypass page-level content restrictions for images whose owning pages have been soft-deleted (moved to the recycle bin). The vulnerability arises because the permission check relies on Page::getPage(), which returns null for soft-deleted pages, causing the PageView check to be skipped silently. Attackers can enumerate image IDs to access metadata of restricted images. Additionally, users with image-update-all or image-delete-all privileges can manipulate images belonging to content they cannot view, causing persistent damage even after page restoration.
Zohocorp ManageEngine DDI Central versions below 6301 contain an improper authorization vulnerability that allows authenticated non-administrative users to delete DNS zones outside their assigned scope. This flaw can lead to significant disruption of DNS services by unauthorized deletion of zones.
Zohocorp ManageEngine DDI Central versions below 6301 contain an authorization bypass vulnerability. This flaw allows authenticated users without administrative privileges to modify Windows DHCP filter-list configurations on clusters for which they are not authorized. The vulnerability has a high severity rating with a CVSS score of 8.1.
Zohocorp ManageEngine DDI Central versions below 6301 contain an authorization bypass and PowerShell command injection vulnerability. This flaw allows authenticated non-administrative users to access unauthorized Windows DHCP subnets and potentially execute arbitrary commands on managed Windows DHCP servers by exploiting crafted DNS suffix values.
A security vulnerability exists in SiteServer SSCMS versions up to 7.2.2 involving the /api/v1/captcha endpoint. Manipulating the argument 'Value' leads to inadequate encryption strength. The flaw can be exploited remotely without authentication. Public exploit code is available. The vendor has not responded to the disclosure.
CVE-2026-125285 is an authentication bypass vulnerability in TIBCO Platform’s Self-Hosted Control Plane versions 1 through 1.21. This flaw allows an attacker to bypass authentication by exploiting an alternate path or channel. The vulnerability has a high severity with a CVSS score of 8.8. No patch or remediation details are currently provided. There are no known exploits in the wild at this time.
CVE-2026-111552 is a vulnerability in Hyper Teknoloji Ltd. Şti.'s Hyper E-Commerce Infrastructure products that use single-factor authentication, allowing authentication bypass. It affects multiple components including the main infrastructure, dealer integration, and storefront application and management panel. The vulnerability is rated high severity with a CVSS score of 7.1.
A weakness in the password recovery mechanism affects multiple components of Hyper Teknoloji Ltd.'s Hyper E-Commerce Infrastructure, including the core infrastructure, dealer integration, and storefront application and management panel. This vulnerability allows exploitation of the password recovery process, potentially leading to unauthorized access. The issue impacts versions before 1.1 for the core infrastructure, before 1.2 for dealer integration, and before 2.1796 for the storefront and management panel.