CVE-2026-93865 is a critical vulnerability in WatchGuard Fireware OS affecting the FireCluster synchronization daemon. It allows a remote, unauthenticated attacker to perform privileged system-level administrative actions by sending specially crafted requests to the FireCluster management IP when clustering is enabled. The flaw is due to missing authentication for a critical function. Fixed versions are available.
The npm package 'string-target-mapper-hash' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee elimination of all malicious software, as the attacker may have gained full control of the system.
The npm package 'macro-kernel-record-reader' is identified as containing malicious code. Any system with this package installed or running is considered fully compromised, potentially allowing an attacker full control over the computer. Immediate rotation of all secrets and keys stored on the affected system is recommended, using a different, uncompromised machine. Removal of the package is advised, but it may not fully eliminate the malicious presence due to possible persistent backdoors or additional malware installed.
The npm package 'fetch-hash-cache-atomic' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a separate, trusted machine. Removal of the package alone is insufficient to guarantee the elimination of all malicious software introduced by this package.
CVE-2026-109823 is a vulnerability in tidewave versions from 0.8.0 up to but not including 0.9.2 that allows an attacker to read filesystem path names exposed via Tidewave configuration endpoints and the rendered toolbar. The issue arises because responses do not validate the Host header, enabling a web page that rebinds its domain to the loopback address to perform same-origin requests and access sensitive path information. This exposure can reveal local usernames and project layout details.
CVE-2026-117510 is a path traversal vulnerability in Dexmal Dexbotic versions 0.1 and 0.2.0. It affects the load_pretrained_gr00t function in the gr00tsonic Checkpoint Loader component. The flaw allows remote attackers to manipulate the weight_map argument to perform path traversal. Exploit code has been published, but no vendor response or patch is currently available.
Authlib versions 1.6.0 through before 1.9.0 contain a vulnerability in the RFC 9101 JAR extension where the attacker-controlled request_uri parameter is passed to a fetch hook without validation at a pre-authentication endpoint. This allows an unauthenticated Server-Side Request Forgery (SSRF) primitive because the documented example implementation performs an unrestricted HTTP GET on the request_uri. The vulnerability arises because the existing allowlist controls for request_uris are ignored, and the extension does not implement required RFC 9101 controls such as validating the URI location, media type, or timeouts. A fix is available in version 1.9.0.
Authlib versions prior to 1.9.0 contain a vulnerability in the OpenID ID token nonce validation process. The ID token's nonce validation can be disabled if the token includes a boolean false nonce_supported claim, causing the expected nonce to be set to None and skipping nonce validation. This allows an attacker to replay a validly signed ID token from a victim into an attacker-controlled session, authenticating as the victim. The vulnerability affects implicit and hybrid flows and direct calls to parse_id_token(), but not the authorization code flow. A fix is available in version 1.9.0.
Authlib versions prior to 1.9.0 have a vulnerability in the default JWT bearer grant implementation where the audience ('aud') claim in JWT assertions is not properly validated. The default get_audiences() method returns an empty list, causing verify_claims() to only check for the presence of an 'aud' claim rather than verifying it matches the authorization server's token endpoint. This allows an attacker with a valid JWT for any audience to obtain an access token from a different authorization server sharing the same signing key.
Authlib versions prior to 1.9.0 contain a vulnerability in the OpenID Connect implicit grant implementation where the authorization request's raw scope parameter is checked instead of the filtered allowed scope. This allows a registered OAuth client, which is not permitted the 'openid' scope but allowed other scopes like 'profile', to obtain a signed ID token if the user consents. The ID token includes identity claims such as 'sub' and 'name', effectively bypassing intended scope restrictions. The issue is fixed in version 1.9.0.
Authlib versions from 1.3.1 up to but not including 1.9.0 contain a vulnerability in the handling of HMAC keys in the jose module. The check that prevents asymmetric public keys from being used as HMAC secrets only inspects the start of the key bytes, but the asymmetric key loader skips leading bytes before the PEM header. This discrepancy allows an attacker with only the issuer's public key to craft a valid HS256 token with arbitrary claims that will be accepted as authentic. The issue is an incomplete fix of a previous vulnerability (CVE-2024-37568) and affects the documented usage of the jwt.decode method. A fix is available in version 1.9.0.
PhpSpreadsheet versions from 5.5.0 up to and including 5.9.0 contain a server-side request forgery (SSRF) vulnerability in the Worksheet\Drawing::setPath() method. The vulnerability arises because the external image URL whitelist check is applied only once on the initial URL, and HTTP redirects are followed without re-validation, allowing an attacker to redirect requests to internal or otherwise restricted endpoints. This results in a blind SSRF where the server issues internal GET requests without exfiltrating response content. A fix is available in version 5.10.0.
PhpSpreadsheet's ODS reader has an unbounded number-rows-repeated attribute handling flaw that can cause memory exhaustion. When processing an OpenDocument Spreadsheet (.ods) file, the reader expands the number-rows-repeated attribute without an upper bound, potentially materializing millions of cells from a small file. This leads to PHP fatal out-of-memory errors. All maintained versions up to 5.9.0 are affected. The vulnerability is fixed in versions 5.10.0, 3.10.8, 2.4.8, 2.1.19, and 1.30.7.
PhpSpreadsheet versions prior to 5.10.0, 3.10.8, 2.4.8, 2.1.19, and 1.30.7 contain a vulnerability in the XmlScanner::scan() method. The scanner's regex pattern only accounts for NULL byte interleaving when detecting <!DOCTYPE declarations, but ISO-2022 escape sequences can bypass this detection. This allows malicious XLSX files with crafted XML to include DOCTYPE declarations that enable XML External Entity (XXE) attacks and Denial of Service (DoS) via quadratic entity expansion. The issue affects all PHP versions for DoS and PHP versions below 8.0 or when LIBXML_NOENT is used for XXE/SSRF. A fix is available in the stated versions.
PhpSpreadsheet's XmlScanner performs two scans on XML content, each followed by an entity decoding callback that runs after pattern checks. This allows a double-encoded entity sequence to bypass detection of dangerous <!DOCTYPE declarations, enabling XML External Entity (XXE) injection and Denial of Service (DoS) via entity expansion. The vulnerability affects PhpSpreadsheet versions >=3.3.0 <3.10.8 and >=4.0.0 <5.10.0. It is exploitable for DoS on all PHP versions and for XXE/SSRF on PHP versions below 8.0 or when LIBXML_NOENT is used. Fixed in versions 3.10.8 and 5.10.0.
A vulnerability in github.com/klauspost/compress/zstd versions prior to 1.20.2 causes a panic due to an out-of-range slice index when decompressing crafted two-block zstd frames. The flaw arises from improper handling of Huffman-weight tables in the FSE decoder, leading to reuse of stale state and an invalid decode table. This can crash any program decompressing untrusted zstd input. The issue is fixed in version 1.20.2.
Authlib versions from 0.13 up to 1.7.2 contain a vulnerability in the is_secure_transport() function, which incorrectly treats certain HTTP URLs with userinfo components as secure loopback addresses. This allows an attacker to bypass the TLS enforcement by crafting URLs like http://localhost:80@evil.example/cb, where the actual host is external but the function returns true due to a prefix string match. This flaw affects OAuth 2.0 / OIDC endpoint and redirect URI validation, potentially allowing cleartext HTTP URLs to be accepted where TLS is required. The issue is fixed in Authlib 1.8.0.
A vulnerability in dnspython's dns.name.from_wire_parser() function allows a maliciously crafted DNS message to cause excessive CPU usage during DNS name decompression. This can degrade application performance or lead to denial of service (DoS) when processing untrusted DNS wire format messages. The issue is fixed in dnspython version 2.9.0. No known workarounds exist.
A regular expression denial of service (ReDoS) vulnerability exists in Datadog's dd-trace-py library affecting the URL query string obfuscation pattern used in HTTP tracing integrations. The vulnerable regex can cause excessive CPU consumption and stall request processing when handling certain attacker-controlled inputs, leading to denial of service. This issue affects ddtrace versions from 1.5.0 up to but not including 3.19.9, and from 4.0.0 up to but not including 4.15.6. A fix is available in versions 3.19.9 and 4.15.6. Workarounds involve setting environment variables to use a fixed regex pattern. The vulnerability is enabled by default in affected HTTP integrations that include query strings in URL span tags.
A vulnerability in dd-trace-py's IAST instrumentation can cause a denial of service by terminating the Python application process when processing certain attacker-controlled inputs. This issue affects only applications with IAST enabled, which is disabled by default. The flaw arises from improper handling of internal errors in string-processing instrumentation. Exploitation requires the vulnerable dd-trace-py version with IAST enabled and exposure of the affected operation to attacker input. A fix is available in version 4.15.5.