A critical security vulnerability exists in the Trino package due to the Eclipse Jetty Digest authentication server-side component using ISO-8859-1 encoding for passwords. This flaw affects versions of Trino prior to 484-r0 and can lead to high confidentiality and availability impacts. A fix is available in version 484-r0.
CVE-2026-109469 is a critical authorization bypass vulnerability in Microsoft Entra Device Registration. It involves a user-controlled key that allows an unauthorized attacker to elevate privileges over a network. This vulnerability has a CVSS score of 10.0, indicating maximum severity. An official fix is available from Microsoft.
CVE-2026-59104 is an authentication bypass vulnerability in SPH Engineering's UgCS server versions before 6.2. The flaw exists in the HCI protocol login handler on TCP port 3334, where if the user database contains exactly one user, a login request with empty credentials is accepted as that single user. The service listens on all interfaces without TLS by default, allowing unauthenticated remote attackers with network access to port 3334 to obtain an authenticated session and issue privileged commands such as controlling drones and uploading flight routes.
A heap-based buffer overflow vulnerability exists in the TDS prelogin parser of the Babelfish for PostgreSQL extension versions 1.0-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4, and in Amazon Aurora PostgreSQL with Babelfish. This flaw allows remote attackers to execute arbitrary OS commands as the database process user by sending a specially crafted malformed TDS prelogin packet to the TDS port. A related NULL-pointer dereference issue in the same parser is also consolidated in this record. Users are advised to upgrade to fixed versions or apply recommended workarounds.
Chartbrew versions 4.8.5 through 5.2.2 contain a server-side request forgery (SSRF) vulnerability. Authenticated users with permission to manage API connections can enable the internal allowPrivateHost field, bypassing restrictions on private and reserved network destinations. This allows requests to internal HTTP services accessible from the Chartbrew server, potentially exposing sensitive information or triggering unauthorized actions. The vulnerability is fixed in version 5.2.3.
Chartbrew versions prior to 5.2.3 expose the BullMQ administrative dashboard at /apps/queues without authentication. This allows remote unauthenticated attackers to access queue management functions if Redis and BullMQ are enabled and the route is reachable. Attackers can inspect job payloads and logs, and potentially retry, delete, or alter jobs, impacting confidentiality, integrity, and availability. The issue is fixed in version 5.2.3.
Chartbrew versions prior to 5.2.3 contain a critical vulnerability where default, weak, or known cryptographic keys (CB_SECRET) are used to sign session tokens. This allows attackers to forge HS256 tokens to impersonate any user without needing their password or two-factor authentication. The vulnerability affects the session JWT fallback verification in multiple server modules and impacts deployments using default or weak CB_SECRET values. The issue is fixed in version 5.2.3.
CVE-2026-54349 is a critical SQL injection vulnerability in Chartbrew versions prior to 5.2.1. It arises from unsafe handling of attacker-controlled JavaScript replacement strings in SQL dashboard-variable substitution, affecting public and embedded charts that use URL-controlled variables in stored SQL queries. The flaw allows unauthenticated users to inject SQL commands that can read, modify, or delete data accessible by the database account. The vulnerability is fixed in version 5.2.1.
JupyterLab Desktop versions prior to 4.6.2-1 contain a critical cross-site scripting (XSS) vulnerability. This flaw allows an attacker to execute arbitrary JavaScript code in the Welcome renderer by submitting crafted remote-server URLs, potentially leading to arbitrary code execution with the user's privileges. The vulnerability also involves unsafe rendering of RSS news-feed titles, which could be exploited if an attacker controls the content of the Jupyter Blog feed or its cached data. The issue affects all supported platforms and is fixed in version 4.6.2-1.
JupyterLab Desktop versions prior to 4.6.2-1 contain an open redirect vulnerability (CWE-601) that allows an attacker to craft a malicious link in an untrusted notebook. When a user opens this notebook and clicks the link, the application navigates to an attacker-controlled site which can then access sensitive local server information and authentication tokens. This enables the attacker to use the Jupyter REST API to create and trust a notebook that executes arbitrary code as the victim. The vulnerability is fixed in version 4.6.2-1.
CVE-2026-63439 is a critical improper authentication vulnerability in Bubka 2FAuth versions prior to 8.0.0. When the AUTHENTICATION_GUARD is set to reverse-proxy-guard, the application trusts the REMOTE_USER identity header or a custom header without verifying the request's origin from a trusted proxy. This allows remote attackers who can access the application directly to forge identity headers and authenticate as any user, including administrators, potentially exposing stored 2FA secrets and management functions. The issue is fixed in version 8.0.0.
CVE-2026-63438 is a critical improper authentication vulnerability in Bubka's 2FAuth web application prior to version 8.0.0. When configured with AUTHENTICATION_GUARD=reverse-proxy-guard, the application incorrectly accepts authentication headers from clients not passing through a trusted proxy. This flaw allows unauthenticated remote clients to create administrator accounts on fresh instances or impersonate existing users by synchronizing email headers, exposing two-factor authentication secrets and administrative functions. The issue is resolved in version 8.0.0.
TracecatHQ's tracecat versions from 0.37.0 up to but not including 1.0.0-beta.49 have a critical vulnerability in Docker Compose deployments with SAML enabled. The vulnerability allows an unauthenticated attacker to bypass signature verification of SAML assertions and responses, enabling session hijacking for existing users, including superadmin account takeover. This flaw is fixed in version 1.0.0-beta.49, which enforces signed assertions and responses.
A vulnerability in LXD (Incus) allows bypassing project restrictions that are intended to block low-level container operations. Specifically, instance snapshots ignore the 'restricted.containers.lowlevel=block' setting, enabling attackers to abuse low-level hooks like 'raw.lxc' and 'raw.qemu' to execute arbitrary commands on the host with root privileges. This can be exploited by crafting a malicious snapshot locally and restoring it in a restricted project on a remote server, resulting in full command execution on the Incus server.
A critical arbitrary file write vulnerability exists in the Incus (LXD) client when it processes a malicious image server's crafted Incus-Image-Hash header. This flaw allows an attacker to write files to arbitrary locations on the server filesystem, potentially leading to root command execution. The vulnerability arises because the client trusts the Incus-Image-Hash header before validating the downloaded image's SHA-256 hash, enabling directory traversal attacks. A proof-of-concept demonstrates writing to /etc/cron.d to achieve remote code execution. This issue is fixed in version 0.0.0-20260630083100-c5184be310b1.
LXD (Incus) contains a vulnerability in its backup compression algorithm handling that allows argument injection. The software validates only the first token of the user-supplied compression algorithm against an allowlist but does not reject extra arguments. This flaw enables an attacker to inject additional command-line arguments, leading to arbitrary file writes on the host system and potentially arbitrary command execution. A proof-of-concept demonstrates uploading a malicious cron job file via this injection. The vulnerability is rated critical with a CVSS score of 9.9 and has been patched in version 0.0.0-20260630083100-c5184be310b1.
A vulnerability in LXD allows a specially crafted container image with a malicious rootfs symlink to perform arbitrary file read and write operations on the host filesystem. This occurs because the image validation process does not properly handle duplicate top-level rootfs symlinks, enabling root-level access to the host. The flaw can lead to arbitrary command execution on the host system.
CivetWeb versions up to 1.16, when built with HTTP/2 support enabled, contain a use-after-free vulnerability in the HTTP/2 request handling function. This flaw allows unauthenticated remote attackers to send crafted HEADERS frames that omit critical pseudo-headers, potentially influencing the request method or path used by access rules or causing a server crash.