The twilio-labs netlify-okta-auth package up to version 1.0.2 has a vulnerability where it relies on an unverified 'iss' claim. This affects outbound HTTP requests used to retrieve a public signing key and may cause additional issues if the oktaUrl configuration is missing or incorrect. The vulnerability is classified under CWE-669, indicating incorrect resource transfer between security spheres.
Yealink UVC40 E2 devices running firmware versions before 319.410.0.71 contain a vulnerability that allows an attacker with brief physical access to extract Wi-Fi credentials via the USB interface. This flaw also enables abuse of sensitive firmware configuration data to escalate privileges to root. An attacker within Wi-Fi range can then perform audio and video eavesdropping without triggering any LED alert on the device.
CVE-2026-114722 is a vulnerability in Roundcube Webmail before versions 1.6.20 and 1.7.5 that allows a CSS scoping bypass in HTML messages. The issue arises because the function rcube_utils::mod_css_styles() does not correctly treat certain CSS at-rule prologues and selectors, causing styles from HTML messages to affect the entire Roundcube interface instead of being confined to the message body. This can enable UI redressing and spoofing attacks. The vulnerability has been fixed in Roundcube versions 1.6.20 and 1.7.5.
CVE-2026-93856 is a medium severity vulnerability in OpenStack Cinder up to version 29.0.0 where non-admin users with project-scoped 'member' or 'reader' roles can retrieve non-expired user messages from other projects via the Block Storage API v3.3 "List messages" call. This leads to cross-project information disclosure of resource UUIDs and sanitized user messages. The issue is fixed starting from version 26.3.1.
Openwave Webtop Media Transcoder versions before 1.1.22.0 do not enforce administrator-defined file type restrictions for file conversions. This allows authenticated users to convert file types beyond those intended by administrators, potentially leading to unintended processing of documents. The vulnerability has a medium severity with a CVSS score of 4.3 and does not impact confidentiality or integrity but may affect availability.
Wheels versions 4.0.0 through 4.1.2 contain a vulnerability where scope conditions are replaced by primary-key conditions in certain methods, allowing unauthorized access to records. This can enable an attacker with limited privileges to load, modify, or delete records belonging to other users or tenants. The issue is fixed in version 4.2.0 by properly combining key and scope conditions in affected methods.
Backdrop CMS versions 1.34.x before 1.34.6 and 1.35.x before 1.35.2 have a vulnerability related to improper handling of tokens in the token browser. The system does not sufficiently restrict access to token types available for selection, potentially exposing sensitive dynamic data placeholders. However, individual token names remain protected.
CVE-2026-106555 is a low-severity vulnerability in OpenSSH versions before 10.6 where the GSSAPIAuthentication state can be incorrectly persisted across authentication attempts. This issue relates to incorrect resource transfer between security contexts during authentication. The vulnerability has a CVSS score of 2.2, indicating low impact, primarily affecting confidentiality with limited attack vector and complexity.
CVE-2026-106553 is a low-severity vulnerability in OpenSSH versions before 10.6 where credentials may persist incorrectly after a failed GSSAPIAuthentication attempt. This issue relates to improper resource handling during authentication failures.
CVE-2026-47574 is a vulnerability in NVIDIA Virtual GPU Manager for Linux involving incorrect resource transfer between spheres. Exploitation could allow attackers to execute code, cause denial of service, escalate privileges, disclose information, or tamper with data. The vulnerability has a high severity score of 7.8. No affected versions or patch information are provided in the available data.
Pexip Infinity versions before 38.2, as well as versions 39.0, 39.1, and 40.0, contain a vulnerability due to improper input validation in an internal service. This flaw allows an attacker with local access and the ability to run arbitrary code on a node to escalate privileges to root. Exploitation requires prior code execution or administrative OS access. The vulnerability has a high severity score of 7.8.
In Oraios AI Serena before 1.0.0, the listen address of the MCP server in HTTP mode is 0.0.0.0. NOTE: the Supplier observed that 0.0.0.0 was a "potential security hazard" but the Serena documentation, at the time of the issue report proposing 127.0.0.1 instead of 0.0.0.0, recommended "use a sandboxed environment for running Serena."
CVE-2025-45480 is a vulnerability in projectfloodlight Floodlight where a port is misclassified as a non-boundary, allowing disruption of host communication through link spoofing. The issue is categorized under CWE-669, indicating incorrect resource transfer between security spheres. The vulnerability has a low CVSS score of 3.1, reflecting limited impact with no confidentiality or availability loss, but some integrity impact. No affected versions or patch information are provided.
CVE-2026-89162 is a medium severity vulnerability in PCRE2 versions 10.45 up to but not including 10.48. It involves an incorrect resource transfer issue in the pcre2_serialize_encode function that may disclose two bytes of information to an adversary. This typically occurs in scenarios where the adversary already has unsafe access. The vulnerability does not affect integrity or availability and requires local access with high attack complexity.
CVE-2026-87724 is a medium severity vulnerability in Tor before version 0.4.9.12. It allows remote attackers to cause a denial of service by triggering a crash. The issue arises because Tor processes the CC_RESPONSE extension even when the CC_REQUEST extension was not sent, which corrupts the congestion-control state and leads to a crash.
CVE-2026-86144 is a vulnerability in libxml2's xinclude functionality before version 2.15.4 where certain parsing flags, such as XML_PARSE_NONET, are not propagated during processing. This can lead to security issues including XML external entity injection, server-side request forgery (SSRF), or denial of service if a custom resource loader accesses attacker-controlled internet resources.
Roundcube Webmail versions before 1.6.18 and 1.7.x before 1.7.3 contain a vulnerability due to improper sanitization of the SVG animate "by" attribute. This flaw may allow bypassing remote image blocking, potentially leading to information disclosure or privilege escalation. The vulnerability has a medium severity rating with a CVSS score of 5.8.
Roundcube Webmail versions before 1.6.18 and 1.7.x before 1.7.3 contain a vulnerability in the modoboa driver of the password plugin that can leak a Modoboa API authentication token to a user-controlled host via crafted session data. This issue affects only instances using the password plugin with the modoboa driver and has a medium severity rating with a CVSS score of 6.4.
Roundcube Webmail versions before 1.6.18 and 1.7.x before 1.7.3 contain a vulnerability where an unclosed url() in a FuncIRI attribute of an SVG image can bypass remote image blocking. This flaw may lead to information disclosure or privilege escalation.