CKEditor 5 versions from 45.0.0 up to but not including 47.7.4, and from 48.0.0 up to but not including 48.5.1, contain a cross-site scripting (XSS) vulnerability due to prototype pollution in a vulnerable es-toolkit version used by the editor engine. This flaw allows crafted editor content to execute unauthorized JavaScript in the browser. The issue is resolved in versions 47.7.4 and 48.5.1.
OAuthLib versions from 4.5.1_3 up to but not including 4.5.1_14 contain a vulnerability in the device workflow implementation of the OAuth 2.0 device authorization grant (RFC 8628). The token endpoint does not properly validate the device_code parameter, allowing an attacker who knows a valid client ID for a public client to obtain a bearer token without a valid device_code. This flaw arises because the DeviceCodeGrant.validate_token_request method lacks proper device_code validation and mishandles public clients. A fix is available in version 4.5.1_14.
CKEditor 5 versions from 29.0.0 up to but not including 47.7.4, and from 48.0.0 up to but not including 48.5.1, contain a cross-site scripting (XSS) vulnerability when General HTML Support is enabled and configured to allow object content. This vulnerability allows specially crafted markup to execute attacker-controlled JavaScript in a browser context isolated from the embedding application's origin. The issue is fixed in versions 47.7.4 and 48.5.1.
CVE-2026-113719 is a vulnerability in virtualenv's app-data seeder where the removal of previously installed seed packages does not properly validate deletion paths. This allows deletion of files outside the intended environment if malicious distribution metadata is present. The flaw occurs during environment creation when reusing an existing environment containing manipulated package metadata. The issue was introduced in version 20.8.1 and fixed in versions 1.6.2 and 1.18.1_2 of the affected product. Exploitation requires attacker-controlled metadata and deletion rights by the invoking user. The CVSS score is 4.5 (medium severity).
undici's WebSocket client, including Node.js's bundled globalThis.WebSocket, is vulnerable to a denial of service condition caused by unbounded automatic PONG buffering. A malicious WebSocket server can send continuous PING frames causing the client to queue PONG responses without respecting backpressure, leading to memory exhaustion and process termination. This affects undici versions from 5.15.0 up to but not including 6.29.1, 7.0.0 up to 7.30.1, and 8.0.0 up to 8.12.2. Upgrading to versions 6.29.1, 7.30.1, or 8.12.2 mitigates the issue by properly handling backpressure.
A Regular Expression Denial of Service (ReDoS) vulnerability exists in Symfony's HeaderUtils::split() method, reachable via the Cache-Control HTTP request header. The vulnerability arises from a regex pattern that inefficiently handles whitespace, causing exponential backtracking and high CPU usage when processing crafted headers. This can lead to significant request processing delays or dropped header directives. Fixed versions are available starting from 5.4.54, 6.4.46, 7.4.19, and 8.1.7.
A denial of service vulnerability exists in go-jose when parsing JWKs containing RSA keys with crafted parameters. The vulnerability arises because go-jose does not validate bounds on RSA modulus and primes before calling crypto/rsa.PrivateKey.Validate(), which on Go 1.24+ has cubic time complexity relative to key size. This allows an attacker to supply a malicious JWK that causes excessive CPU consumption during parsing. The issue affects go-jose versions prior to 4.1.6 and 3.0.5 and has been fixed in version 4.1.6.
CTFer.io's CTFd Terraform Provider improperly stores team passwords as non-sensitive values in the Terraform state file. This allows local or remote attackers with access to the Terraform state to read team passwords without needing the state decryption password. The vulnerability is identified as CWE-522 and affects versions from 0.1.5 through 1.1.0 and all versions prior to 2.8.2. A patch is available in version 2.8.2. No workaround exists, but limiting access to the Terraform state file is recommended to reduce risk.
This vulnerability allows an authenticated user with the Restore Operator role, who can control the contents of a backed-up NAS share, to perform relative path traversal and write attacker-controlled files to arbitrary paths on the backup server. The flaw requires high privileges and user interaction is not needed. The vulnerability has a medium severity rating with a CVSS score of 5.9. No affected versions or patches are specified in the available data.
CVE-2026-118171 is a missing authorization vulnerability in the strapi/content-manager package of Strapi Open Source and Enterprise Headless CMS version 5.51.0. It allows low-privileged administrators to generate preview URLs without possessing the necessary document identifiers or read permissions.
Strapi Open Source and Enterprise Headless CMS version 5.51.0 is vulnerable to a semi-blind Server-Side Request Forgery (SSRF) via webhook follow-redirect behavior. The webhook dispatcher follows HTTP redirects automatically without resolving the IP address after the redirect or checking if the redirected address is within private or link-local network ranges. This can lead to non-2xx HTTP responses from target endpoints being captured and reflected back to the caller.
CVE-2026-118170 is a broken access control vulnerability in the strapi/review-workflows package of Strapi Open Source and Enterprise Headless CMS version 5.51.0. It allows unauthorized updates to documents without verifying the caller's update rights.
CVE-2026-116658 is a denial of service vulnerability in Tanium Enforce caused by a NULL pointer dereference. It affects versions 2.9 up to but not including 2.9.736, 2.10 up to but not including 2.10.778, and 3.0 up to but not including 3.0.373. The vulnerability has been fixed in versions 2.9.736, 2.10.778, and 3.0.373. The CVSS v3.1 base score is 6.5, indicating a medium severity impact, with no confidentiality or integrity impact but a high impact on availability.
Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC. From version 3.0.0 until 3.1.5, Neko deployments with legacy mode and session.implicit_hosting enabled incorrectly authorize legacy WebRTC data-channel input because LegacyIsHost() evaluates host status incorrectly. An authenticated room member who establishes a WebRTC connection can send mouse and keyboard events through the legacy control channel while controls are locked or the member is otherwise unauthorized by the modern control API. This issue is fixed in version 3.1.5.
CVE-2026-87085 is a SQL injection vulnerability in Tanium Provision that allows improper neutralization of special elements used in SQL commands. This flaw was addressed by Tanium in versions 1.17.150, 1.23.161, and 1.24.199. The vulnerability has a medium severity with a CVSS score of 6.5, indicating it requires low privileges to exploit and can impact confidentiality, integrity, and availability to a limited extent.
GnuPG version 2.5.21 for Windows has a vulnerability due to incorrect permission assignment on the C:\ProgramData directory. This allows low-privilege users to create subdirectories and inject malicious configuration files that GnuPG components will consume, potentially leading to code execution under the victim user's security context.
CVE-2026-57194 is an out-of-bounds write vulnerability in the chan_unistim module of Asterisk, an open source telephony toolkit. The flaw allows an attacker to overflow the phone_number field and crash the system by sending a crafted incoming request packet. Exploitation requires the chan_unistim module to be loaded and configured with a reachable UNISTIM UDP port, and the attacker must register as a configured phone MAC or use an equivalent provisioning path. This vulnerability affects multiple Asterisk versions prior to fixed releases and has a medium severity rating with a CVSS score of 5.9.