The CTFer.io Terraform Provider for CTFd versions from 0.1.5 up to but not including 2.8.2 stores the ctfd_team.password value in Terraform state as a non-sensitive value. This means that anyone with access to the Terraform state file can read team passwords without needing additional decryption. The vulnerability is fixed in version 2.8.2.
When logging in to a Matrix account, Thunderbird used the homeserver address provided in the server's login response without validating it. A malicious or compromised homeserver could provide a file: URL, causing Thunderbird to send all further Matrix requests of that session to local files or, on Windows, to an attacker-controlled network share, which could leak the user's NTLM credentials.
The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
Clicking a news: or snews: link that referenced a message-ID made Thunderbird connect, without asking, to the host and port given in the link, even if it was not a configured news server. Line breaks in the message-ID were sent to the server unmodified, so a crafted link could send arbitrary commands to services reachable from the user's network. In addition, snews: links to such servers connected without TLS. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
A remote RSS feed could use the itunes:new-feed-url or newLocation element to permanently change its stored subscription URL to a file: URL. Thunderbird then read that location on every feed update. This allowed a malicious feed, or an attacker able to modify a feed delivered over HTTP, to make Thunderbird read local files and, on Windows, connect to an attacker-controlled network share, which could leak the user's NTLM credentials.
The NTLM credential leak only affects Thunderbird on Windows. Other operating systems are affected by the local file read only. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
When looking for calendars in a directory on a server, during account setup or when adding a new network calendar, Thunderbird accepted calendar locations pointing to other servers, local files or network shares. A malicious server, or a network attacker when the lookup used plain HTTP, could make Thunderbird subscribe to such a location. On Windows this could leak the user's NTLM credentials to an attacker-controlled host on every calendar refresh, and changes to the calendar could be written to the attacker's share or overwrite a local file. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
Thunderbird's check that prevents mailbox: URLs from accessing files on remote Windows network shares could be bypassed using extended-length UNC paths. Displaying a specially crafted email could cause Thunderbird to connect to an SMB server chosen by the attacker, disclosing the user's Windows account name and NTLM authentication data, which could be used for offline password cracking or relay attacks.
This bug only affects Thunderbird on Windows. Other operating systems are unaffected. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
When replying to, forwarding, or editing a crafted email message as new, Thunderbird could embed parts of a different message stored in the same folder into the message being composed, without showing a blocked content warning. If the user sent the message, the content of the other message was disclosed to the recipients. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
When a message containing an OpenPGP key attachment was displayed, Thunderbird automatically loaded the attachment's content to offer importing the key. A sender could mark the attachment as an external attachment pointing to an arbitrary URL, which Thunderbird then loaded without any user interaction, bypassing remote content blocking. On Windows, a URL pointing to an attacker-controlled network share could leak the user's NTLM credentials.
The NTLM credential leak only affects Thunderbird on Windows. On other operating systems, the issue allowed a remote request that bypassed remote content blocking. This vulnerability was fixed in Thunderbird 159 and Thunderbird 153.6.
MISP Guard, a proxy enforcing security policies on MISP feed data, had an incomplete input validation flaw in its handling of required taxonomy tags. The guard verified only that at least one tag from a required taxonomy was allowed but failed to ensure all tags from that taxonomy were permitted. This allowed events or attributes to carry both allowed and non-allowed tags simultaneously, bypassing data classification restrictions and potentially exposing sensitive data to unauthorized feed consumers. The vulnerability affected event-level and attribute-level validations, including nested and shadow attributes. It was fixed in version 1.4.
CVE-2026-115413 is a vulnerability in AWS aws-api-mcp-server versions 1.3.0 up to but not including 1.6.0. It involves missing token audience validation in the OAuth authentication mode, which could allow local users to perform AWS operations using the server's configured AWS credentials with an access token issued to another application by the same identity provider. The issue is fixed in version 1.6.0 by adding proper token audience or client ID validation.
CVE-2026-118171 is a missing authorization vulnerability in the strapi/content-manager package of Strapi Open Source and Enterprise Headless CMS version 5.51.0. It allows low-privileged administrators to generate preview URLs without possessing the necessary document identifiers or read permissions.
Strapi Open Source and Enterprise Headless CMS version 5.51.0 is vulnerable to a semi-blind Server-Side Request Forgery (SSRF) via webhook follow-redirect behavior. The webhook dispatcher follows HTTP redirects automatically without resolving the IP address after the redirect or checking if the redirected address is within private or link-local network ranges. This can lead to non-2xx HTTP responses from target endpoints being captured and reflected back to the caller.
CVE-2026-118170 is a broken access control vulnerability in the strapi/review-workflows package of Strapi Open Source and Enterprise Headless CMS version 5.51.0. It allows unauthorized updates to documents without verifying the caller's update rights.
CVE-2026-57202 is a high-severity vulnerability in Asterisk prior to versions 20.20.1, 21.12.3, 22.10.1, 23.4.1 and certain Certified Asterisk releases. An authenticated attacker with read-only Asterisk REST Interface (ARI) credentials can exploit the setChannelVar function to perform write dialplan operations, including file writes, even when the 'live_dangerously' setting is disabled. The vulnerability requires the Asterisk HTTP server to be enabled and accessible, which is disabled by default and bound to localhost. This issue has been fixed in the stated versions.
CVE-2026-57188 is a high-severity stack buffer overflow vulnerability in the res_xmpp module of Asterisk, an open source telephony toolkit. It affects versions prior to 20.20.1, 21.12.3, 22.10.1, 23.4.1 and certain Certified Asterisk releases. An authenticated attacker with an XMPP account on the same or federated server can exploit this by sending crafted packets to cause out-of-bounds writes. The vulnerability requires the res_xmpp module to be loaded and an XMPP connection configured. Fixed versions are available.
CVE-2026-116682 is a path traversal vulnerability in the FileBrowser Quantum web-based file manager. Before versions 1.5.2-stable and 2.0.1-beta, the backend improperly resolves symbolic links without verifying that the target remains within the user's authorized directory scope. This allows authenticated users with download access, and even unauthenticated users via public share links, to read files outside their assigned scope by exploiting reachable symlinks. The issue is fixed in versions 1.5.2-stable and 2.0.1-beta.
CVE-2026-117526 is a code injection vulnerability in reduxjs redux-devtools version 5.0.0. It affects the evalAction function of the Remotedev Server component. The vulnerability allows an attacker with local access to manipulate the action argument to inject code. Exploit code has been publicly disclosed. The project has been informed but has not yet responded or issued a fix.
HomeBox versions prior to 0.27.0 contain a server-side request forgery (SSRF) vulnerability due to improper handling of HTTP redirects in notifier URL validation. Authenticated users can exploit this by configuring notifier hosts that redirect to restricted internal addresses, bypassing SSRF protections. The issue affects immediate and scheduled notifier requests. It is fixed in version 0.27.0.
CVE-2026-88812 is a high-severity vulnerability in X.Org X Server and X Wayland involving a double free in the XKB SetGeometry function. This flaw affects versions of xorg-x11-server before 21.1.25 and X Wayland before 24.1.14. Exploitation could allow attached clients to cause a crash or potentially execute code within the X server context. The issue has been fixed in versions 21.1.25 and 24.1.14.