CTFd versions from 3.1.0 up to but not including 3.8.7 have an information disclosure vulnerability in the /api/v1/teams endpoint. This flaw allows unauthenticated attackers to enumerate non-public custom fields of teams, exposing sensitive registration data such as emails, phone numbers, and student IDs when team mode and public visibility are enabled.
CVE-2026-121558 is an authorization bypass vulnerability in the Ricky-7-Yan intelligent-audit-system (AuditPilot) before commit 4669c93. It allows authenticated users with read:knowledge permission scoped to one project to access knowledge from other projects by manipulating the project_id parameter in certain API endpoints. This vulnerability affects version 0 of the product and has a low severity rating with a CVSS score of 2.3.
DbGate versions before 7.3.3 have a missing authorization vulnerability that allows authenticated users with connection restrictions to bypass LOGIN_PERMISSIONS. The functions test() and save() do not call the required testConnectionPermission, enabling attackers to submit arbitrary connection definitions to endpoints that test or save connections. This can be used to probe internal database hosts or overwrite stored connections.
AB Download Manager versions prior to 1.11.2 contain a cross-site request forgery (CSRF) vulnerability in an unauthenticated browser-integration API. This flaw allows remote attackers to write arbitrary files to arbitrary paths by sending crafted requests to the /start-headless-download endpoint. Exploitation can lead to placing malicious payloads in startup folders, resulting in code execution upon the next user login. The vulnerability is rated high severity with a CVSS 4.0 score of 8.7. A fix is available in version 1.11.2.
Red Hat has released a critical security update for Red Hat OpenShift GitOps version 1.21.7 addressing multiple vulnerabilities including CVE-2026-75838. The update fixes issues such as malformed version strings in the Argo Rollouts controller and other security flaws identified by CWEs 79, 125, and 295. Users are advised to apply this update after ensuring all prior relevant errata are installed.
Wasmtime before 36.0.19, 37.0.0 before 48.0.7, and 49.0.0 before 49.0.4 contains a request smuggling vulnerability in wasi-http that allows guests to set multiple conflicting content-length headers. Malicious guests can make the host send HTTP requests with conflicting content-length values to smuggle requests through servers or intermediaries that do not reject them.
Wasmtime 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 fails to check forwarded trailers against the WasiHttpHooks::is_forbidden_header hook in wasi-http p3. WASIp3 guests can forward a request or response body so its trailers skip embedder-customized forbidden header filtering, undermining header restrictions the embedder intended.
Wasmtime versions 46.0.0 before 48.0.7 and 49.0.0 before 49.0.4 contain a vulnerability in the wasi-http p3 component that allows malicious guests to set unvalidated content-length headers. This flaw enables response splitting or injection attacks by splicing an existing body into a new response with an incorrect content-length.
Red Hat JBoss Web Server 7.0.3 includes multiple security fixes addressing vulnerabilities in components such as mod_cluster, Apache Tomcat, and Tomcat Native library. These fixes resolve issues including unauthenticated denial of service, authentication bypass, HTTP/2 request smuggling, TLS security weaknesses, and client certificate verification race conditions. The update replaces version 7.0.2 and is rated as having an important security impact by Red Hat.
Apache HertzBeat versions 1.7.1 through 1.9.0 contain an XPath injection vulnerability due to incomplete validation of XPath expressions in the HTTP collector XML parsing path. Authenticated users with permission to create monitor templates can supply crafted XPath expressions that are evaluated without proper validation, potentially causing excessive CPU consumption and impairing collector availability. This issue is a follow-up to a previous incomplete fix (CVE-2026-24343). The vulnerability is fixed in version 1.9.1, and users are advised to upgrade.
CVE-2026-105982 is a vulnerability involving improper input validation in the IPsec VPN function. It allows a remote attacker with high privileges to inject system commands and execute them with root privileges. The vulnerability has a high severity score of 7.2 and impacts confidentiality, integrity, and availability.
Zohocorp ManageEngine Log360 and EventLog Analyzer versions 13071 and below have an authentication bypass vulnerability in the local collector registration process. This flaw allows an unauthenticated attacker to register a local collector by sending a specially crafted registration request. The vulnerability has a high severity with a CVSS score of 7.5, indicating a network attack vector with no required privileges or user interaction and high confidentiality impact. No patch or remediation information is provided in the available data.
CVE-2026-96889 is a security advisory related to Red Hat AI Base Images 3.4.7 (ROCm 7.1). The advisory references two CVEs, including CVE-2026-111497, which describes a high-severity out-of-bounds write vulnerability in the Google Brotli decoder. This vulnerability can be triggered by a crafted Brotli-compressed stream, potentially leading to memory disclosure, denial of service, or arbitrary code execution when decompressing untrusted Brotli data. Red Hat rates this issue as Important with high attack complexity due to required conditions for exploitation and platform hardenings. No fixes are currently available for the Red Hat AI Base Images 3.4.7, and affected versions are not explicitly stated.
Red Hat AI Base Images 3.4.7 (CUDA 12.9) are referenced in a security advisory that includes multiple CVEs, notably CVE-2026-111497, which involves an out-of-bounds write vulnerability in the Google Brotli decoder. This flaw can be triggered by a crafted Brotli-compressed stream during decompression, potentially leading to memory disclosure, denial of service, or arbitrary code execution. The advisory rates this issue as Important with high attack complexity and notes that Red Hat platform hardenings increase exploitation difficulty. No fixes are currently available for the AI Base Images 3.4.7, and the advisory does not specify affected versions or remediation steps for this product. The vulnerability impacts decompression of untrusted Brotli data in affected environments.