https://vulnfeed.org/Every disclosure, as it lands. Critical-only feed available.enhttps://vulnfeed.org/cve/CVE-2026-63471/https://vulnfeed.org/cve/CVE-2026-63471/Tue, 03 Nov 2026 19:18:44 +0000fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an OpenAPI path into a generated @app.get(...) route decorator as a single-quoted generated route string without escaping embedded quotes. An attacker-controlled or attacker-influenced OpenAPI path can close the string and inject a valid Python expression into the decorator argument. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the application's or CI process's privileges when the generated module is imported and the decorator is evaluated. This OpenAPI path sink is distinct from the project's separate operation-summary docstring and additional-response-key sinks. This issue is fixed in version 0.8.1.https://vulnfeed.org/cve/CVE-2026-57154/https://vulnfeed.org/cve/CVE-2026-57154/Tue, 03 Nov 2026 19:18:06 +0000OPNsense is a FreeBSD based firewall and routing platform. Prior to 26.1.11 and 26.4.1p1, authenticated Web UI or API users with delegated access to affected settings can submit CR or LF characters in fields expected to contain one line, causing generated privileged service configuration files to contain additional attacker-controlled directives or policy lines. The confirmed Dnsmasq path includes dhcp_boot.filename, dhcp_boot.servername, dhcp_boot.address, and dhcp_options.value, which are rendered into /usr/local/etc/dnsmasq.conf; access through page-services-dnsforwarder covers api/dnsmasq/*. Related affected fields span OpenVPN, DHCPv6, Unbound, IPsec, NTP, PPP or MPD, Monit, firewall, sudo, WebGUI, and System General configuration. Applying or restarting the affected service can alter behavior beyond the delegated setting, create service-side files, cross RBAC boundaries, or cause denial of service. Line injection through Monit mail password and adjacent Monit text fields into /usr/local/etc/monitrc demonstrated root command execution. Arbitrary shell command execution was not confirmed for the Dnsmasq path. This issue is fixed in versions 26.1.11 and 26.4.1p1.https://vulnfeed.org/cve/CVE-2026-112917/https://vulnfeed.org/cve/CVE-2026-112917/Tue, 03 Nov 2026 19:17:53 +0000In Docker Desktop for Windows with the WSL2 backend, an unprivileged Linux container can use 32-bit socketcall to bypass the default seccomp restriction on AF_VSOCK. This can expose host-facing services and Windows files accessible to the logged-in user. The issue affects x86-64 WSL2; LinuxKit-based backends are unaffected. The issue is fully fixed only with Docker Desktop 4.98.0 or later and WSL 3.0.3 or later. Docker Desktop 4.98.0 or later running on an older WSL remains affected.https://vulnfeed.org/cve/CVE-2026-63469/https://vulnfeed.org/cve/CVE-2026-63469/Tue, 03 Nov 2026 19:15:54 +0000fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts an additional response status-code key into the generated responses={...} route-decorator dictionary as a single-quoted Python string without escaping embedded quotes. A multi-response OpenAPI operation with an attacker-controlled or attacker-influenced second non-primary response key can close the dictionary-key literal and inject a valid Python expression. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the application's or CI process's privileges when the generated module is imported and its decorator arguments are evaluated. This additional-response-key sink is distinct from the project's separate route-path and operation-summary sinks. This issue is fixed in version 0.8.1.https://vulnfeed.org/cve/CVE-2026-63470/https://vulnfeed.org/cve/CVE-2026-63470/Tue, 03 Nov 2026 19:13:47 +0000fastapi-code-generator creates FastAPI applications from OpenAPI files. Prior to 0.8.1, the generator inserts Operation.summary into a generated route-handler docstring as a triple-double-quoted string without escaping embedded triple quotes. An attacker-controlled or attacker-influenced operation summary can close the docstring and inject a valid Python expression statement into the handler body. Syntax-breaking input only causes generation to fail, but syntactically valid generated code executes with the server process's privileges when the affected route handler is called. This call-time route-handler docstring sink is distinct from the project's separate import-time route-path and additional-response-key sinks. This issue is fixed in version 0.8.1.https://vulnfeed.org/cve/CVE-2026-39379/https://vulnfeed.org/cve/CVE-2026-39379/Tue, 03 Nov 2026 18:46:29 +0000GeoNetwork is a catalog application to manage spatially referenced resources. From 3.0.0 until 4.2.15 and 4.4.10, requesting a nonexistent or unauthorized service URL can cause an error page to reflect attacker-controlled request content inside an AngularJS application without adequately neutralizing it for template evaluation. A remote attacker can induce a victim, including an administrator, to open a crafted link so the reflected value is evaluated as an AngularJS template expression. Combined with known AngularJS sandbox-escape techniques, this can execute arbitrary JavaScript in the victim's authenticated browser session, disclose information, or perform actions as the victim. This issue is fixed in versions 4.2.15 and 4.4.10.https://vulnfeed.org/cve/CVE-2026-121382/https://vulnfeed.org/cve/CVE-2026-121382/Tue, 03 Nov 2026 18:45:19 +0000A vulnerability was determined in Netcore NBR100V2 1.3.240614.030928. Affected by this issue is the function msg_aes_dec of the file /usr/bin/auto_ac. This manipulation causes integer overflow. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.https://vulnfeed.org/cve/CVE-2026-46487/https://vulnfeed.org/cve/CVE-2026-46487/Tue, 03 Nov 2026 18:44:42 +0000GeoNetwork is a catalog application to manage spatially referenced resources. From 4.0.0-alpha.1 until 4.2.16 and 4.4.11, the Elasticsearch-backed search proxy can skip GeoNetwork's access-control filter injection when a client request has an omitted query field. The request is then forwarded to Elasticsearch without group visibility, draft exclusion, record ownership, or portal-specific filtering. An unauthenticated remote attacker can use the affected public search API to retrieve the full indexed contents of metadata records that should not be publicly visible. This issue is fixed in versions 4.2.16 and 4.4.11.https://vulnfeed.org/cve/CVE-2026-120955/https://vulnfeed.org/cve/CVE-2026-120955/Tue, 03 Nov 2026 18:42:39 +0000The GridFS file download API in the MongoDB C Driver does not check the result of an internal operation under certain error conditions during file retrieval. This can cause the process to terminate when stream operations continue. A user who can influence file download parameters can trigger this condition, which may result in service unavailability for applications using the affected API.https://vulnfeed.org/cve/CVE-2026-120956/https://vulnfeed.org/cve/CVE-2026-120956/Tue, 03 Nov 2026 18:41:44 +0000The MongoDB C Driver does not validate the type or format of a namespace field returned by the server in a query response. A MongoDB endpoint that a client application connects to, without needing any credentials, can return a malformed value in that field. This causes the client application process to terminate, and can also cause the driver to read memory outside an allocated buffer and to send a small amount of the application's own uninitialized heap memory back to the endpoint in a follow-up command. The impact is limited to the process that embeds the driver.https://vulnfeed.org/cve/CVE-2026-120678/https://vulnfeed.org/cve/CVE-2026-120678/Tue, 03 Nov 2026 18:39:32 +0000A memory management flaw in the MongoDB C Driver's handling of compressed responses may cause the client library to hold on to memory that is never released. An unauthenticated party that controls the database endpoint a client application connects to may cause repeated, unbounded memory growth in that application, which may result in the application becoming unavailable. No credentials, transport security settings, or user interaction are required.https://vulnfeed.org/cve/CVE-2026-63198/https://vulnfeed.org/cve/CVE-2026-63198/Tue, 03 Nov 2026 18:38:35 +0000traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, OAuth2 silent authorization requests using prompt=none with an empty or omitted scope parameter check prior consent against the empty requested scope set even though all scopes registered for the client become eligible for issuance. An attacker who controls an OAuth client capable of receiving authorization codes can target a user who previously consented to only some client scopes and obtain an access token containing broader registered scopes without additional consent. A user who has never consented to the client still receives consent_required. This issue is fixed in version 3.28.3.https://vulnfeed.org/cve/CVE-2026-82976/https://vulnfeed.org/cve/CVE-2026-82976/Tue, 03 Nov 2026 18:36:24 +0000A flaw was found in the image-customization-controller used in OpenShift's bare metal provisioning stack. The controller registers an HTTP file server on port 8084 with no authentication. The custom imageFileSystem implementation exposes a browsable HTML directory listing of all registered images at the root path. The only access control on per-host images is the random UUID filename; the directory listing discloses those UUIDs to any caller on the provisioning network. Each served image embeds an Ignition config containing the base64-encoded cluster pull secret, optional IRONIC_RAMDISK_SSH_KEY, proxy settings, and per-host NetworkManager keyfiles. An adjacent network attacker can enumerate all image UUIDs via directory listing, download any image, extract the embedded Ignition config, and recover the cluster pull secret and SSH key. ### Evidence **pkg/imagehandler/imagefilesystem.go — root directory is browsable and enumerates all UUID image names** ```go func (f *imageFileSystem) Readdir(n int) ([]fs.FileInfo, error) { f.mu.Lock() defer f.mu.Unlock() result := []fs.FileInfo{} for _, im := range f.images { result = append(result, im) } return result, nil } func (f *imageFileSystem) Open(name string) (http.File, error) { f.log.Info("Open", "path", name) if name == "/" { return f, nil } ... ``` **cmd/controller/main.go — file server bound on all interfaces without auth or TLS** ```go http.Handle("/", http.FileServer(imageServer.FileSystem())) go func() { server := &http.Server{ Addr: imagesBindAddr, // default ":8084" ReadHeaderTimeout: 5 * time.Second, } err := server.ListenAndServe() ``` **pkg/ignition/service_config.go:94-100 — pull secret is embedded in every served image** ```go func (b *ignitionBuilder) authFile() ignition_config_types_32.File { source := "data:;base64," + strings.TrimSpace(b.ironicAgentPullSecret) return ignition_config_types_32.File{ Node: ignition_config_types_32.Node{Path: "/etc/authfile.json"}, ... ``` ### Attack Pattern Adjacent provisio…https://vulnfeed.org/cve/CVE-2026-63197/https://vulnfeed.org/cve/CVE-2026-63197/Tue, 03 Nov 2026 18:26:21 +0000traQ is a messenger application built for Digital Creators Club traP. Prior to 3.28.3, instances configured with TRAQ_STORAGE_TYPE=local can return user-uploaded SVG or HTML content from the /files/{fileId} retrieval endpoint for direct browser rendering. An attacker with file-upload capability can provide crafted active content and induce another user to open its file URL, causing attacker-controlled JavaScript to execute in the victim's browser. This issue is fixed in version 3.28.3.https://vulnfeed.org/cve/CVE-2026-63417/https://vulnfeed.org/cve/CVE-2026-63417/Tue, 03 Nov 2026 18:21:15 +0000Logging Redactor is a Python library designed to redact sensitive data in logs based on regex patterns and / or dictionary keys. Prior to 0.0.7, personally identifiable information returned by custom object __str__ or __repr__ methods is not redacted when such non-primitive objects are logged, causing sensitive values to appear in logs that are expected to mask them. This issue is fixed in version 0.0.7.https://vulnfeed.org/cve/CVE-2026-119922/https://vulnfeed.org/cve/CVE-2026-119922/Tue, 03 Nov 2026 18:08:48 +0000Improper access control in the Babelfish for PostgreSQL extension versions 1.2-1.5, 2.1-2.15, 3.1-3.12, 4.0-4.8, 5.1-5.4 may allow remote authenticated users to elevate their privileges. To remediate this issue, we recommend you upgrade to Babelfish for PostgreSQL extension versions 4.10, 5.6, 6.1 or later.https://vulnfeed.org/cve/CVE-2026-63418/https://vulnfeed.org/cve/CVE-2026-63418/Tue, 03 Nov 2026 18:06:25 +0000Monitoring Plugins is a suite of plugins for monitoring applications. From 3.0.0-rc1 until 3.0.1, check_icmp stores the number of hosts supplied through -H or --Host on the command line, or through --extra-opts files containing Host= entries, in an unsigned short. More than 65,535 hosts wrap the counter, causing process_arguments() to allocate an undersized hosts array and then write subsequent entries out of bounds before main() calls setuid(getuid()). On installations where check_icmp is setuid root, a local low-privileged attacker can corrupt heap memory while the process still has root privileges; reliable privilege escalation has not been demonstrated. Installations that use cap_net_raw file capabilities instead of setuid are not exposed to the privilege-escalation consequence. This issue is fixed in version 3.0.1.https://vulnfeed.org/cve/CVE-2026-44267/https://vulnfeed.org/cve/CVE-2026-44267/Tue, 03 Nov 2026 17:53:42 +0000### Summary An unauthenticated attacker who controls a string passed to any Elo JavaScript-emission path — `defaultFormats.elo.parse()`, the `bin/elo` CLI, or the live browser playground at `elo-lang.org/try` — can execute arbitrary code in the host JavaScript runtime. A payload built from the `.constructor.constructor` chain compiles, without modification, to a live `Function` invocation in the emitted JavaScript, escaping any sandbox assumption around "Elo is a safe data/DSL language." ### Vulnerable sink and root cause Three interacting sites in `src/` produce the bug at commit `749af7b`: 1. **`src/transform.ts:144–158`** — the `member_access` handler allows access on types `any`, `object`, or `array` without filtering the property name. This is the only place an integrator could have plugged a denylist. 2. **`src/compilers/javascript.ts:210`** — the JS emitter writes `${objectExpr}.${ir.property}` verbatim into the output, so any property name that survives the transform step flows unescaped into emitted JavaScript. 3. **`src/parser.ts:163–170, 748–750`** — the parser accepts `constructor` (and other JS meta-property names) as an ordinary identifier, so `.constructor` clears type-checking without triggering any warning. Combined, the Elo expression `({}).constructor.constructor('…')()` compiles to a live `Function('…')()` call in the emitted JS, executing in the realm of whichever sink runs the compiled code. ### Attack surfaces All three surfaces share the same root cause (no denylist in `transform.ts`) and are addressed by the same one-file patch: | # | Entry point | Threat model | |---|---|---| | 1 | Browser playground — `https://elo-lang.org/try/?code=…&run=1` | **0-click XSS / account takeover** against elo-lang.org. `?run=1` triggers `setTimeout(() => this.run(), 100)` in `playground_controller.ts:531`; the server issues a 301 that preserves `?code=`. Any shared URL that contains a payload compromises the visitor's session on elo-lang.org. | | 2 | `bin/el…https://vulnfeed.org/cve/CVE-2026-44266/https://vulnfeed.org/cve/CVE-2026-44266/Tue, 03 Nov 2026 17:51:30 +0000### Summary Elo's Ruby backend emits attacker-controlled text into Ruby double-quoted strings without escaping the `#` character. Because `#` begins Ruby's interpolation sequences — `#{expr}`, `#@ivar`, `#@@cvar`, `#$gvar` — and any expression wrapped in `#{...}` may use backticks for shell execution, an Elo program that contains a crafted string literal or a labelled subtype constraint compiles to Ruby that evaluates attacker-chosen Ruby, and through backticks runs attacker-chosen shell commands, at runtime. The same Elo source compiled to JavaScript, Python, or SQL is benign, so the bug also breaks the cross-target portability guarantee the rest of the compiler honours. ### Vulnerable sinks Two sinks exist in `src/compilers/ruby.ts` at commit `749af7b`: 1. **String-literal emitter — lines 180–184.** The emitter escapes backslash, double quote, and control characters, but not `#`. Any `#{...}` sequence in an Elo string literal flows straight into the emitted Ruby source. 2. **Labelled subtype-constraint branch — lines 405–412.** The error message passed to `p_fail(p, "...")` is wrapped in a Ruby double-quoted string with no escape pass at all. Because the parser at `src/parser.ts:1339–1348` accepts single-quoted Elo strings as constraint labels, a label such as `'#{` `` `id` `` `}'` flows unchanged into the emitted Ruby. ### Attack surfaces All three surfaces share the same root cause (the missing `#` escape in the Ruby double-quoted-string emission path) and are addressed by the same patch: | # | Entry point | Threat model | |---|---|---| | 1 | `/try` playground on elo-lang.org (Ruby target) | 0-click server-side RCE against elo-lang.org infrastructure from a shared PoC URL | | 2 | `bin/eloc -t ruby -x` on a CI or DevOps host | RCE on any host that passes Elo strings through the CLI | | 3 | Library API — `defaultFormats.elo.parse()` with a Ruby emission step | Ruby RCE for any downstream integrator using Elo as a rule engine, configuration DSL, or form builder DS…https://vulnfeed.org/cve/CVE-2026-44265/https://vulnfeed.org/cve/CVE-2026-44265/Tue, 03 Nov 2026 17:47:03 +0000Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, Elo's programmatic AST API accepts arbitrary values from JSON-deserialized input, plugin output, or other untyped sources and interpolates them into generated JavaScript, Ruby, Python, or SQL without runtime syntax validation. The affected fields are int_literal / float_literal .value, variable.name, member_access.property, object_literal keys, datapath segments, lambda.params[].name, and the SQL let binding name. Crafted values become executable expressions or identifiers, allowing arbitrary code execution in JavaScript, Ruby, and Python targets and SQL injection in the SQL target. This programmatic AST-object path is distinct from the plain-string constructor-chain sandbox escape. This issue is fixed in version 1.0.1.https://vulnfeed.org/cve/CVE-2026-11800/https://vulnfeed.org/cve/CVE-2026-11800/Tue, 03 Nov 2026 17:24:27 +0000### Description A flaw was found in Keycloak. This JWT algorithm confusion vulnerability in the JWT Authorization Grant flow allows an attacker with valid client credentials to bypass signature verification. By forging an assertion, the attacker can create unauthorized access tokens. This enables the attacker to impersonate any federated user linked to the affected Identity Provider, leading to unauthorized access and potential privilege escalation.https://vulnfeed.org/cve/CVE-2026-28327/https://vulnfeed.org/cve/CVE-2026-28327/Tue, 03 Nov 2026 17:18:12 +0000SolarWinds Dameware was found to be affected by a DLL hijacking vulnerability. The hijack occurs during installations only and requires access to the local machine and admin privileges.https://vulnfeed.org/cve/CVE-2026-28335/https://vulnfeed.org/cve/CVE-2026-28335/Tue, 03 Nov 2026 17:18:12 +0000SolarWinds Dameware was found to be affected by a buffer overflow vulnerability that can result in remote code execution. Authentication is required.https://vulnfeed.org/cve/CVE-2026-28336/https://vulnfeed.org/cve/CVE-2026-28336/Tue, 03 Nov 2026 17:18:12 +0000SolarWinds Dameware was found to be affected by a command injection vulnerability that could lead to the compromise of the remotely controlled host. Authentication is required.https://vulnfeed.org/cve/CVE-2026-119675/https://vulnfeed.org/cve/CVE-2026-119675/Tue, 03 Nov 2026 17:18:07 +0000MongoDB Database Tools mongorestore inconsistently handles the system.buckets. prefix when validating collection names in an untrusted dump. A specially crafted collection name can bypass special-collection guards and operator namespace filters, causing a restore to create an unauthorized user-chosen database account, including an account with the root role. Exploitation requires an operator to restore unauthorized user-controlled data using credentials with sufficient user-management privileges on the destination deployment. Excluding the admin namespace alone does not prevent this behavior. This issue affects MongoDB Database Tools versions 100.4.0 through versions before 100.20.1.https://vulnfeed.org/cve/CVE-2026-109593/https://vulnfeed.org/cve/CVE-2026-109593/Tue, 03 Nov 2026 17:17:53 +0000An unauthenticated attacker with network access to the SonicWall GMS 9.5.2 and earlier versions may be able to read internal GMS files, potentially exposing sensitive information.https://vulnfeed.org/cve/CVE-2026-103916/https://vulnfeed.org/cve/CVE-2026-103916/Tue, 03 Nov 2026 17:17:52 +0000Docker Sandboxes sbx cp does not safely confine host-side paths to a shared workspace. A malicious sandbox can create or replace a workspace symlink so that a later user-initiated copy reads a host file outside the workspace into the sandbox or writes sandbox-controlled data to a host path outside the workspace with the invoking user's permissions.https://vulnfeed.org/cve/CVE-2026-121624/https://vulnfeed.org/cve/CVE-2026-121624/Tue, 03 Nov 2026 17:13:52 +0000Nanosystems Supremo for Windows and macOS before 5.0.2.3874 contains an improper certificate validation vulnerability that allows adjacent attackers to intercept TLS connections by presenting untrusted certificates. Attackers on the same network can terminate and relay the client's TLS session using self-signed certificates to read usernames, SHA-256 password hashes, and license codes.https://vulnfeed.org/cve/CVE-2026-115714/https://vulnfeed.org/cve/CVE-2026-115714/Tue, 03 Nov 2026 16:44:18 +0000Improper Certificate Validation (CWE-295) in the operating system certificate bundle shipped in the Docker images of APM Server; Auditbeat, Filebeat, Heartbeat, Metricbeat and Packetbeat; Elastic Agent, including Fleet Server and Cloudbeat; Logstash, for TLS connections that use the operating system certificate bundle; Elastic connectors; Universal Profiling (host agent, collector and symbolizer); and Elastic Maps Server. This certificate bundle, a dependency of these products (Dependency on Vulnerable Third-Party Component, CWE-1395), could allow an attacker to intercept or modify TLS-protected traffic via Signature Spoofing by Key Theft (CAPEC-474). The certificate bundle includes root certificate authorities that signed eight eMudhra intermediate certificate authorities whose private keys are compromised. Anyone with these keys can issue a certificate for any host name that these products accept as trusted. Exploitation requires an attacker in a network position between the product and the remote party, who presents a certificate issued with one of the compromised keys.https://vulnfeed.org/cve/CVE-2026-115294/https://vulnfeed.org/cve/CVE-2026-115294/Tue, 03 Nov 2026 16:44:04 +0000Improper Limitation of a Pathname to a Restricted Directory (CWE-22) in the Kibana Fleet feature can lead to unauthorized resource deletion via Path Traversal (CAPEC-126). A low-privileged user with Fleet agent policies write access could cause a subsequent administrative action to act on unintended resources. This can result in the deletion of resources such as Kibana spaces and other organizational assets that the low-privileged user cannot delete directly. Exploitation requires an administrator to interact with the affected Fleet interface.https://vulnfeed.org/cve/CVE-2026-115290/https://vulnfeed.org/cve/CVE-2026-115290/Tue, 03 Nov 2026 16:43:59 +0000Uncontrolled Recursion (CWE-674) in Elasticsearch can lead to denial of service via Serialized Data with Nested Payloads (CAPEC-230). An unauthenticated attacker with network access to the remote cluster server interface of a node can send a specially crafted request that causes the node to terminate. No credentials are required. The attacker can repeat the request against each reachable node.https://vulnfeed.org/cve/CVE-2026-121602/https://vulnfeed.org/cve/CVE-2026-121602/Tue, 03 Nov 2026 16:26:54 +0000Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server to corrupt memory by sending overlong channel names in JOIN or SJOIN messages. Attackers controlling a peer server can trigger strcpy and sprintf overflows in ms_join and ms_sjoin to crash the ircd or potentially achieve remote code execution.https://vulnfeed.org/cve/CVE-2026-121603/https://vulnfeed.org/cve/CVE-2026-121603/Tue, 03 Nov 2026 16:26:54 +0000Solanum before commit 2ea1382 contains a buffer overflow vulnerability in ms_kill() that allows malicious linked servers to corrupt memory by sending an overlong kill reason. Attackers controlling a rogue or compromised peer server can send a reason exceeding KILLLEN that overflows a static 512-byte buffer, crashing the ircd or potentially achieving remote code execution.https://vulnfeed.org/cve/CVE-2026-65168/https://vulnfeed.org/cve/CVE-2026-65168/Tue, 03 Nov 2026 16:17:36 +0000NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code.https://vulnfeed.org/cve/CVE-2026-121561/https://vulnfeed.org/cve/CVE-2026-121561/Tue, 03 Nov 2026 16:17:28 +0000Label Studio before 1.23.2 (label-studio-sdk before 2.1.2) contains a server-side request forgery vulnerability that allows authenticated users to read internal URLs through image-bearing export formats. Attackers can import tasks with data.image pointing at internal services, export as YOLO or COCO with images to read responses, and spoof Host to capture the organization owner's API token.https://vulnfeed.org/cve/CVE-2026-119215/https://vulnfeed.org/cve/CVE-2026-119215/Tue, 03 Nov 2026 15:46:32 +0000Authorization Bypass Through User-Controlled Key vulnerability in team-alembic ash_authentication allows a user with an account to install a TOTP secret they control on another user's account, and then sign in as that user or hold their second factor. AshAuthentication.Strategy.Totp.ConfirmSetupChange verified a setup token but did not check that it was issued to the record being confirmed, so an attacker's own pending secret could be confirmed onto another user's record. The TOTP setup changes, ConfirmSetupChange, GeneratePendingSetupChange and GenerateSecretChange, also marked their changesets as AshAuthentication interactions, which the standard AshAuthenticationInteraction policy bypass lets through. A policy limiting setup and confirm_setup to the actor's own record therefore never ran when an application exposed those actions by record key, and a direct setup call on another user's record returned that user's pending secret and setup token. This issue affects ash_authentication: from 5.0.0-rc.0 before 5.0.0-rc.16.https://vulnfeed.org/cve/CVE-2026-121260/https://vulnfeed.org/cve/CVE-2026-121260/Tue, 03 Nov 2026 15:30:19 +0000A flaw has been found in Ziroom ZHOME A0101 1.0.1.0 Build 202004151405. This issue affects the function loadstring of the file usr/lib/lua/luci/controller/api/zrUsb.lua of the component Lua Handler. This manipulation causes code injection. Remote exploitation of the attack is possible. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.https://vulnfeed.org/cve/CVE-2026-118487/https://vulnfeed.org/cve/CVE-2026-118487/Tue, 03 Nov 2026 15:27:18 +0000In Eclipse Vert.x versions [4.0.0, 4.5.35] or [5.0.0, 5.2.2], the `FrameParser` in vertx-stomp creates a `RecordParser` without setting `maxRecordSize`, so any peer that streams bytes continuously without a newline character causes the parser to accumulate data indefinitely. Both the STOMP server and the STOMP client are affected: a malicious server can exploit this against a connecting client, and a malicious client can exploit this against a server before or after authentication. Sustained byte streaming exhausts JVM heap memory, crashing the affected process and causing a complete denial of service.https://vulnfeed.org/cve/CVE-2026-119741/https://vulnfeed.org/cve/CVE-2026-119741/Tue, 03 Nov 2026 15:26:27 +0000rsync through 3.5.1 contains a denial of service vulnerability in the delta-transfer sender's hash_search() in match.c that allows malicious receivers to trigger unbounded strong-checksum work at consecutive offsets. Unauthenticated attackers pulling from a public daemon module can supply weak checksums colliding with consecutive rolling windows plus non-matching strong checksums, exhausting sender CPU across concurrent connections.https://vulnfeed.org/cve/CVE-2026-106991/https://vulnfeed.org/cve/CVE-2026-106991/Tue, 03 Nov 2026 15:17:19 +0000hustoj >=24.09.10 and <=26.08.19 is vulnerable to Incorrect Access Control. Any registered user can delete, lock, or sticky any forum thread (including admins' announcements) via threadadmin.php. The thread branch only verifies login, never authorship or admin rights.https://vulnfeed.org/cve/CVE-2026-73328/https://vulnfeed.org/cve/CVE-2026-73328/Tue, 03 Nov 2026 15:17:18 +0000Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload vulnerability that allows authenticated users to upload PHP files via the /upload/send/ endpoint. Attackers can submit base64 fileContent with a .php fileName into the web root and request it to execute code as the web server user.https://vulnfeed.org/cve/CVE-2026-121560/https://vulnfeed.org/cve/CVE-2026-121560/Tue, 03 Nov 2026 15:17:16 +0000LogChimp 0.9.0-alpha.1 before 0.9.3 contains an authorization bypass vulnerability that allows authenticated post authors to modify any other post by supplying mismatched postId and id body parameters. Attackers can set postId to their own post and id to an enumerated victim post UUID to overwrite its title, slug, content, boardId and roadmap_id.https://vulnfeed.org/cve/CVE-2026-121559/https://vulnfeed.org/cve/CVE-2026-121559/Tue, 03 Nov 2026 15:17:15 +0000GLPI 10.0.0 before 10.0.28 and 11.0.0 before 11.0.10 contains a privilege escalation vulnerability that allows authenticated users to obtain elevated profiles by cloning accounts. A user with the Technician profile can clone a Super-Admin account with a new login and password, since User::getCloneRelations() copies every Profile_User and Group_User assignment without permission checks, yielding an attacker-controlled Super-Admin account.https://vulnfeed.org/cve/CVE-2026-121557/https://vulnfeed.org/cve/CVE-2026-121557/Tue, 03 Nov 2026 15:17:14 +0000WPPConnect Server through 2.10.74 contains a missing authentication vulnerability that allows unauthenticated attackers to send WhatsApp messages by calling the Chatwoot webhook route without verifyToken middleware. Attackers who know or guess a connected session name can POST outgoing message bodies to send arbitrary texts or files from that account to any number.https://vulnfeed.org/cve/CVE-2026-121556/https://vulnfeed.org/cve/CVE-2026-121556/Tue, 03 Nov 2026 15:17:13 +0000FastBee through 2.1.0 contains an insecure direct object reference vulnerability in ProductController that allows authenticated tenant users to access other tenants' products by supplying their product IDs. Attackers can enumerate sequential product IDs to read MQTT account, password, and secret values, overwrite product configuration including tenant_id, or delete products with cascading rows.https://vulnfeed.org/cve/CVE-2026-121554/https://vulnfeed.org/cve/CVE-2026-121554/Tue, 03 Nov 2026 15:17:12 +0000cordova-plugin-advanced-http through 3.3.1 contains an information disclosure vulnerability that leaks cookies to third-party hosts by forwarding an explicitly set Cookie header across cross-origin redirects. Attackers controlling a redirect target, via an open redirect or attacker-supplied URL, can receive the original host's session cookies and hijack user sessions.https://vulnfeed.org/cve/CVE-2026-121555/https://vulnfeed.org/cve/CVE-2026-121555/Tue, 03 Nov 2026 15:17:12 +0000Foxel through 2.4.0 contains a missing authentication vulnerability that allows unauthenticated attackers to read files by requesting the /api/fs/stream and /api/fs/thumb endpoints. Attackers can supply a VFS mount prefix and relative path to retrieve full file contents or thumbnails across all mounts, bypassing PathRule permission grants.https://vulnfeed.org/cve/CVE-2026-121548/https://vulnfeed.org/cve/CVE-2026-121548/Tue, 03 Nov 2026 15:17:08 +0000Jarun nnn through 5.3 contains an OS command injection vulnerability in plugins/togglex that allows attackers to execute commands via crafted filenames. Attackers can place files whose names contain a double quote and shell syntax, which xargs -I splices into an sh -c script, running commands as the user invoking togglex.https://vulnfeed.org/cve/CVE-2026-121543/https://vulnfeed.org/cve/CVE-2026-121543/Tue, 03 Nov 2026 15:17:04 +0000smart-sso through 2.0.1 contains an incorrect authorization vulnerability in PermissionFilter that allows any authenticated user to call admin console APIs because unlisted paths are permitted by default. Attackers can call /admin/user-role/save to assign themselves the administrator role, reset passwords, and manage users, roles, and applications across integrated systems.https://vulnfeed.org/cve/CVE-2026-121451/https://vulnfeed.org/cve/CVE-2026-121451/Tue, 03 Nov 2026 15:17:01 +0000AB Download Manager before 1.11.2 contains a cross-site request forgery vulnerability in its unauthenticated browser-integration API that allows remote attackers to write attacker-chosen files to arbitrary paths. A malicious web page can send a text/plain request to /start-headless-download with crafted folder and name values, placing payloads in startup folders for code execution on next login.https://vulnfeed.org/cve/CVE-2026-121452/https://vulnfeed.org/cve/CVE-2026-121452/Tue, 03 Nov 2026 15:17:01 +0000bbs-go through 4.4.6 contains an improper certificate validation vulnerability that allows network-positioned attackers to intercept SMTP traffic because sendEmail() sets InsecureSkipVerify to true. Attackers can present any certificate to capture SMTP PLAIN auth credentials and read or modify outgoing password-reset and verification emails.https://vulnfeed.org/cve/CVE-2026-121450/https://vulnfeed.org/cve/CVE-2026-121450/Tue, 03 Nov 2026 15:17:00 +0000CFNext before 3.1.0 contains a weak cryptographic derivation vulnerability that allows subscription link holders to recover the admin password because the subscription UUID is an MD5 of the password with a fixed public salt. Attackers can brute-force the password offline without rate limiting, log into the admin panel, and read stored Trojan, Clash, Telegram and Cloudflare API secrets.https://vulnfeed.org/cve/CVE-2026-118489/https://vulnfeed.org/cve/CVE-2026-118489/Tue, 03 Nov 2026 14:55:48 +0000In Eclipse Vert.x versions [4.0.0,4.5.35] or [5.0.0,5.2.2], when one `CachingWebClient` is shared across users — the documented pattern of a per-user `WebClientSession` over a shared caching client — a response that is specific to one user but is cacheable and not marked `private`/`no-store` is stored in the client-level shared cache tier and served to other users requesting the same URL. A later user's session, or an anonymous caller through the same client, can receive an earlier user's response. Depending on the response this discloses authenticated content or a session cookie, the latter enabling session fixation or hijacking.https://vulnfeed.org/cve/CVE-2026-118527/https://vulnfeed.org/cve/CVE-2026-118527/Tue, 03 Nov 2026 14:53:28 +0000Ivanti Connect Secure contains a generation of predictable numbers or identifiers vulnerability that allows a remote authenticated attacker to upload files with attacker-controlled content to a known location on disk. This vulnerability can be chained with CVE-2026-104935 and CVE-2026-111357.https://vulnfeed.org/cve/CVE-2026-121449/https://vulnfeed.org/cve/CVE-2026-121449/Tue, 03 Nov 2026 14:28:37 +0000Dockhand from 1.0.47 before 1.0.54 exposes plaintext stack secrets because deployStack() attaches resolved secret values to its result as resolvedSecrets, which Git-stack routes return unfiltered. Holders of a stack's webhook secret or users with stacks:start permission can trigger the Git stack webhook, manual deploy, or create-and-deploy endpoints to receive stored and external-provider secrets such as 1Password or Vault values.https://vulnfeed.org/cve/CVE-2026-121448/https://vulnfeed.org/cve/CVE-2026-121448/Tue, 03 Nov 2026 14:28:36 +0000Dockhand before 1.0.54 contains a path traversal vulnerability that allows authenticated users to read, overwrite, and delete .env files outside the stacks root by double-encoding the stack name. Attackers can send %252e%252e sequences to /api/stacks/[name]/env/raw to disclose cross-environment secrets, write into protected directories, or poison deployment variables.https://vulnfeed.org/cve/CVE-2026-121445/https://vulnfeed.org/cve/CVE-2026-121445/Tue, 03 Nov 2026 14:28:34 +0000darylldoyle svg-sanitizer from 1.0.0 before 1.1.0 contains a regular expression denial of service vulnerability in the image-set pattern of stripRemoteCssTokens() when removeRemoteReferences is enabled. Attackers can submit SVGs with many unclosed image-set tokens to exhaust CPU, or trigger PCRE limits causing sanitize() to throw a TypeError and leave unsanitized content.https://vulnfeed.org/cve/CVE-2026-121444/https://vulnfeed.org/cve/CVE-2026-121444/Tue, 03 Nov 2026 14:28:33 +0000svg-sanitizer from 0.11.0 before 1.1.0 contains an algorithmic complexity denial of service vulnerability in hasInfiniteLoop() and countUse() of the use reference-graph analysis. Attackers can upload a small layered SVG with 15 levels of fanned-out use elements, forcing exponential path enumeration that pins PHP workers for hours.https://vulnfeed.org/cve/CVE-2026-121437/https://vulnfeed.org/cve/CVE-2026-121437/Tue, 03 Nov 2026 14:28:29 +0000Mistune from 3.3.0 before 3.3.4 contains a denial of service vulnerability that allows remote attackers to exhaust CPU through quadratic-time emphasis delimiter processing. Attackers can submit small markdown documents with repeated patterns like "*a_b" to trigger an O(n²) index-fixup loop, stalling workers for seconds.https://vulnfeed.org/cve/CVE-2026-121436/https://vulnfeed.org/cve/CVE-2026-121436/Tue, 03 Nov 2026 14:28:28 +0000Froxlor from 2.3.8 before 2.3.15 contains an information disclosure vulnerability that allows administrators with customers_see_all to view every account's API key and secret through an unscoped WHERE 1 query in api_keys.php. Attackers can read the super administrator's apikey and secret from the detail modal and replay them to the API to gain super administrator control.https://vulnfeed.org/cve/CVE-2026-121429/https://vulnfeed.org/cve/CVE-2026-121429/Tue, 03 Nov 2026 14:28:23 +0000AzuraCast through 0.23.8 contains a command injection vulnerability that allows station users with Profile permission to execute OS commands via StereoTool settings. Attackers can inject shell metacharacters into stereo_tool_configuration_path or stereo_tool_license_key, which are executed via /bin/sh on station restart, compromising the container.https://vulnfeed.org/cve/CVE-2026-121427/https://vulnfeed.org/cve/CVE-2026-121427/Tue, 03 Nov 2026 14:28:22 +0000AzuraCast through 0.23.8 fails to remove frontend_config.custom_config in PUT /station/{id}/profile/edit for users lacking the Manage station broadcasting permission, and the stored JSON is written verbatim as key=value lines into the Shoutcast sc_serv.conf file. An authenticated user with only the Manage station profile permission can override adminpassword, password, and portbase, or inject arbitrary directives via newlines in keys, hijacking the station's Shoutcast frontend.https://vulnfeed.org/cve/CVE-2026-121428/https://vulnfeed.org/cve/CVE-2026-121428/Tue, 03 Nov 2026 14:28:22 +0000AzuraCast through 0.23.8 contains a remote code execution vulnerability that allows authenticated station managers to inject Supervisor configuration through the station timezone field. Attackers can submit a timezone containing newlines to the profile edit API, defining a new Supervisor program that executes OS commands as root when configuration regenerates.https://vulnfeed.org/cve/CVE-2026-121426/https://vulnfeed.org/cve/CVE-2026-121426/Tue, 03 Nov 2026 14:28:21 +0000Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that ends an angle-addr at a '>' inside a quoted local part, comment or domain literal. Attackers can submit addresses that validate as an allowed domain but are delivered to an attacker-controlled domain, bypassing recipient allow lists and disclosing message content.https://vulnfeed.org/cve/CVE-2026-121424/https://vulnfeed.org/cve/CVE-2026-121424/Tue, 03 Nov 2026 14:28:20 +0000Nodemailer from 3.0.0 before 10.1.4 contains an address parsing vulnerability in addressparser that allows remote attackers to redirect recipients by ending nested RFC 5322 comments at the first closing parenthesis. Attackers can submit addresses whose nested comment hides an attacker address, bypassing conformant validators and recipient allow lists to receive mail or spoof senders in mailparser.https://vulnfeed.org/cve/CVE-2026-121425/https://vulnfeed.org/cve/CVE-2026-121425/Tue, 03 Nov 2026 14:28:20 +0000Nodemailer from 3.0.0 before 10.1.4 contains a parsing flaw in addressparser that ends an RFC 5322 group at a semicolon inside quoted display names or comments. Attackers can submit crafted group addresses that conformant validators approve, redirecting mail to attacker-chosen recipients and bypassing recipient allow lists.https://vulnfeed.org/cve/CVE-2026-121423/https://vulnfeed.org/cve/CVE-2026-121423/Tue, 03 Nov 2026 14:28:19 +0000SurrealDB before 3.3.0 contains an unbounded recursion vulnerability that allows authenticated users to abort the surreald process by triggering stack overflow on deeply nested values. Attackers can repeatedly run UPDATE statements wrapping a stored array in itself, then SELECT or EXPORT it, causing persistent denial of service for all tenants.https://vulnfeed.org/cve/CVE-2026-121419/https://vulnfeed.org/cve/CVE-2026-121419/Tue, 03 Nov 2026 14:28:16 +0000SurrealDB from 3.1.0 before 3.3.0 contains an improper authentication vulnerability where the MCP BoundSubject fingerprint uses the access method name instead of per-user identity for JWT/Bearer access. Attackers with a valid low-privilege token for the same access method and a victim's mcp-session-id can hijack the session and execute MCP tools with the victim's roles and permissions.https://vulnfeed.org/cve/CVE-2026-121417/https://vulnfeed.org/cve/CVE-2026-121417/Tue, 03 Nov 2026 14:28:15 +0000SurrealDB before 3.3.0 contains a use-after-free vulnerability in surrealdb-core KV backends that pass borrowed transaction state into affinitypool::spawn_local closures relying on future Drop for safety. Rust embedders that leak a dispatched future (e.g. via mem::forget) and drop the transaction cause pool workers to read and write freed memory, risking crashes or memory corruption.https://vulnfeed.org/cve/CVE-2026-121416/https://vulnfeed.org/cve/CVE-2026-121416/Tue, 03 Nov 2026 14:28:14 +0000SurrealDB 2.0.0 before 3.3.1 does not enforce --deny-funcs restrictions on method-style function calls in the streaming engine, because MethodPart::evaluate invokes resolved functions without a capability check. Authenticated users who can submit queries can run denied functions via method syntax, e.g. [1,2].map() or $f.put()/$f.get() to write and read file bucket data despite file::* denials.https://vulnfeed.org/cve/CVE-2026-121414/https://vulnfeed.org/cve/CVE-2026-121414/Tue, 03 Nov 2026 14:28:13 +0000Parse Server before 8.6.110 and 9.0.0 before 9.10.6-alpha.2 fails to contain a serialization error when an object update uses a dot notation key targeting a pointer field's object identifier on a class with an afterSave trigger. Attackers, including unauthenticated clients when objects are writable without a session, can send such an update to crash the Node process.https://vulnfeed.org/cve/CVE-2026-121412/https://vulnfeed.org/cve/CVE-2026-121412/Tue, 03 Nov 2026 14:28:11 +0000FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource consumption vulnerability in the proxy that lets connected clients retain heap memory via intercepted DVC message reassembly. Attackers can declare a large DATA_FIRST length and keep sending fragments without completing the message, growing proxy memory proportional to traffic and degrading service.https://vulnfeed.org/cve/CVE-2026-121409/https://vulnfeed.org/cve/CVE-2026-121409/Tue, 03 Nov 2026 14:28:09 +0000FreeRDP before 3.32.2 contains a denial of service vulnerability that allows malicious servers or unauthenticated peers to abort clients or proxies via oversized X.224 routing tokens. Attackers can send an oversized LoadBalanceInfo in a Server Redirection PDU, or a 240–247 byte token to a FixedTarget freerdp-proxy, triggering a tpdu_write_header assertion that crashes the process.https://vulnfeed.org/cve/CVE-2026-121407/https://vulnfeed.org/cve/CVE-2026-121407/Tue, 03 Nov 2026 14:28:08 +0000FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server's remdesk_server_thread that allows authenticated clients to crash the process via an inverted PDU length check. Attackers can send an 8192-byte remdesk payload declaring an eight-byte PDU length to trigger a fatal Stream_Seek assertion, aborting the server and dropping sessions.https://vulnfeed.org/cve/CVE-2026-121404/https://vulnfeed.org/cve/CVE-2026-121404/Tue, 03 Nov 2026 14:28:06 +0000FreeRDP before 3.32.2 contains a denial of service vulnerability in the shadow server that allows authenticated RDP clients to spin server threads by sending zero-length drdynvc DATA PDUs. Attackers can send empty DATA messages on opened audin or rdpgfx channels, so that FreeRDP_WTSVirtualChannelRead never consumes them, consuming full CPU cores until disconnect.https://vulnfeed.org/cve/CVE-2026-121402/https://vulnfeed.org/cve/CVE-2026-121402/Tue, 03 Nov 2026 14:28:04 +0000FreeRDP before 3.32.2 contains a NULL pointer dereference vulnerability that allows malicious RDP servers to crash xfreerdp clients by sending a zero-width RDPGFX ResetGraphics PDU. The failed resize in gdi_resize_ex leaves the primary display null without ending the session, so a later bitmap update crashes the client in gdi_Bitmap_Paint.https://vulnfeed.org/cve/CVE-2026-121400/https://vulnfeed.org/cve/CVE-2026-121400/Tue, 03 Nov 2026 14:28:03 +0000FreeRDP before 3.32.2 contains a denial-of-service vulnerability in rdg_process_control_packet that allows a malicious RD Gateway to exhaust client CPU by sending an incomplete keepalive control packet. Attackers completing the RDG tunnel-open exchange then send an eight-byte header with packetLength 0xFFFF and withhold the body, causing an unbounded no-progress read loop that spins one client thread at full CPU.https://vulnfeed.org/cve/CVE-2026-121398/https://vulnfeed.org/cve/CVE-2026-121398/Tue, 03 Nov 2026 14:28:01 +0000FreeRDP before 3.32.2 contains a cross-thread use-after-free vulnerability in the freerdp-proxy dyn-channel-dump module during session teardown. A malicious RDP target can send dynamic channel data while the front client disconnects, letting the client thread read freed ChannelData and crash the proxy process.https://vulnfeed.org/cve/CVE-2026-121394/https://vulnfeed.org/cve/CVE-2026-121394/Tue, 03 Nov 2026 14:27:59 +0000FreeRDP from 3.11.0 before 3.32.2 contains an assertion failure in the RemoteFX RLGR decoder that allows malicious servers to terminate clients. Attackers controlling an RDP server can send a RemoteFX tileset with RLGR code 32767, triggering a signed narrowing assertion in rfx_rlgr_decode and crashing the client.https://vulnfeed.org/cve/CVE-2026-121395/https://vulnfeed.org/cve/CVE-2026-121395/Tue, 03 Nov 2026 14:27:59 +0000FreeRDP from 3.17.0 before 3.32.2 contains an assertion failure in the RemoteFX differential decoder when verbose WinPR assertions are enabled. A malicious RDP server can send a crafted RemoteFX tile with adjacent LL3 coefficients summing beyond signed 16-bit range to abort the client process.https://vulnfeed.org/cve/CVE-2026-121393/https://vulnfeed.org/cve/CVE-2026-121393/Tue, 03 Nov 2026 14:27:58 +0000FreeRDP from 3.0.0 before 3.32.2 contains a denial of service vulnerability that allows malicious RDP servers to abort clients built with verbose WinPR assertions by sending crafted RemoteFX region rectangles. Attackers can supply a rectangle with x set to 65535 alongside a SurfaceBits destination left of 1, triggering a 16-bit coordinate assertion in rfx_process_message that terminates the client process.https://vulnfeed.org/cve/CVE-2026-121392/https://vulnfeed.org/cve/CVE-2026-121392/Tue, 03 Nov 2026 14:27:57 +0000FreeRDP before 3.32.2 contains an improper certificate validation vulnerability in tls_verify_certificate() that accepts Common Name fallback despite non-matching SAN entries and matches IP literals against DNS strings. Man-in-the-middle attackers holding a certificate from a client-trusted CA can bypass server identity checks to intercept RDP sessions, including keystrokes, clipboard, and screen content.https://vulnfeed.org/cve/CVE-2026-121388/https://vulnfeed.org/cve/CVE-2026-121388/Tue, 03 Nov 2026 14:27:55 +0000FreeRDP from 3.0.0 before 3.32.2 contains an uncontrolled resource allocation vulnerability that allows malicious RDP servers to force large client allocations through the DRDYNVC DATA_FIRST Length field. Attackers can declare lengths up to 4,294,967,295 bytes on running dynamic channels, causing StreamPool_Take to reserve memory before body validation and exhaust client memory.https://vulnfeed.org/cve/CVE-2026-121386/https://vulnfeed.org/cve/CVE-2026-121386/Tue, 03 Nov 2026 14:27:53 +0000FreeRDP before 3.32.2 contains a denial of service vulnerability in WinPR's winpr_read_png_from_buffer() and winpr_convert_from_jpeg(), which lack libpng/libjpeg error handling. A malicious RDP server or MITM can offer a malformed PNG or truncated JPEG clipboard payload, causing the client to abort or exit.https://vulnfeed.org/cve/CVE-2026-121513/https://vulnfeed.org/cve/CVE-2026-121513/Tue, 03 Nov 2026 14:18:29 +0000Off-by-one Heap Overflow in µD3TN v0.15.1 SPP Parser allows Unauthenticated Remote Attacker to Reliably Cause DoShttps://vulnfeed.org/cve/CVE-2026-121512/https://vulnfeed.org/cve/CVE-2026-121512/Tue, 03 Nov 2026 14:18:19 +0000Memory Leak with Amplification in µD3TN BPv6 EID Reference Handling allows Unauthenticated Remote Attacker to Cause DoShttps://vulnfeed.org/cve/CVE-2026-121511/https://vulnfeed.org/cve/CVE-2026-121511/Tue, 03 Nov 2026 14:18:14 +0000Heap Out-of-Bounds Read in µD3TN BPv6/BPv7 Fragmenter allows Local Attacker to Read Memory and Reliably Cause DoShttps://vulnfeed.org/cve/CVE-2026-121510/https://vulnfeed.org/cve/CVE-2026-121510/Tue, 03 Nov 2026 14:18:09 +0000Remote Unauthenticated Heap Out-of-Bounds Write in µD3TN BPv6 Administrative Record Parser allows Unauthenticated Remote Attacker to Reliably Cause DoShttps://vulnfeed.org/cve/CVE-2026-85035/https://vulnfeed.org/cve/CVE-2026-85035/Tue, 03 Nov 2026 14:17:39 +0000The can_add_rx_filter_msgq() system call installs a CAN RX filter whose callback (can_msgq_put() in drivers/can/can_common.c) is handed the caller's struct k_msgq * as user_data. The controller driver stores that raw pointer in its filter table and dereferences it from the RX path every time a matching frame arrives. The system call verifier z_vrfy_can_add_rx_filter_msgq() in drivers/can/can_handlers.c validated the queue only with K_SYSCALL_OBJ(), which is a point-in-time check of type, initialization and caller permission and says nothing about the object's lifetime. On a build with CONFIG_USERSPACE=y and CONFIG_DYNAMIC_OBJECTS=y, an unprivileged user-mode thread that has been granted access to a CAN device can obtain a message queue whose lifetime it fully controls: k_object_alloc(K_OBJ_MSGQ) followed by k_msgq_alloc_init(). The lifetime of such an object is driven solely by its permission bitmask, and a pointer retained by the kernel is not represented there. After registering the filter, the thread calls k_object_release() — or simply terminates — and unref_check() frees the struct k_msgq storage while the CAN driver still holds the pointer. The next matching CAN frame causes k_msgq_put() to run in supervisor context against freed memory that the attacker can have groomed with another kernel allocation: the frame payload is memcpy()d through the reused block's write_ptr, and the queue's wait_q (and poll_events under CONFIG_POLL) list nodes are manipulated. This yields kernel-heap corruption reachable from a user-mode thread, defeating the isolation CONFIG_USERSPACE is intended to provide; the same dangling pointer also arises benignly when an application thread exits without calling can_remove_rx_filter(). The fix validates the queue with K_SYSCALL_OBJ_STATIC(), which additionally rejects objects carrying K_OBJ_FLAG_ALLOC, so only statically defined queues (CAN_MSGQ_DEFINE()) may be registered from user mode. Supervisor-mode callers bypass the verifier and mus…https://vulnfeed.org/cve/CVE-2026-120572/https://vulnfeed.org/cve/CVE-2026-120572/Tue, 03 Nov 2026 14:17:35 +0000Incorrect boundary conditions in the Layout: Block and Inline component. This vulnerability was fixed in Firefox 159.0.1.https://vulnfeed.org/cve/CVE-2026-119179/https://vulnfeed.org/cve/CVE-2026-119179/Tue, 03 Nov 2026 14:17:33 +0000A flaw in the connection management layer of the MongoDB Node.js driver can leave a pooled network connection in the pool for reuse while data from an earlier operation is still outstanding on it. In applications that enable an optional client-side operation timeout, an unauthenticated party that can send ordinary requests to the application may cause database replies to be paired with the wrong requests. This may result in unintended disclosure of other users' records, incorrect operation results being returned, and failures of legitimate requests.https://vulnfeed.org/cve/CVE-2026-121506/https://vulnfeed.org/cve/CVE-2026-121506/Tue, 03 Nov 2026 14:17:24 +0000An out-of-bounds read and write in NTS client extension field parsing (extens_client_recv) in NTPsec before 1.2.5 allows a remote attacker who can send NTP server-mode replies to an NTS client to corrupt heap memory and crash ntpd, and, combined with the NTS-KE client out-of-bounds read fixed in 1.2.4, to bypass NTS authentication and set the client's time, via an NTS Authenticator and Encrypted Extension Fields field whose nonce length exceeds the field.https://vulnfeed.org/cve/CVE-2026-119742/https://vulnfeed.org/cve/CVE-2026-119742/Tue, 03 Nov 2026 13:43:57 +0000Nagios XI before 2026R2 contains an OS command injection vulnerability in the MIB upload feature where the install_mib() function in mibs.php sanitizes uploaded filenames with an incomplete character deny-list that omits semicolons and pipes before passing them to a grep command executed via exec(). An authenticated administrator can upload a MIB file with a crafted filename using tab characters to bypass the deny-list and pipe to sh via a multipart POST request to mibs.php, resulting in arbitrary OS command execution as the web server user.https://vulnfeed.org/cve/CVE-2026-108047/https://vulnfeed.org/cve/CVE-2026-108047/Tue, 03 Nov 2026 13:17:17 +0000Inadequate authorization vulnerability in Alosuite’s user invitation functionality. The ‘/Requests/userInvitation’ endpoint does not properly validate the assignment of privileges on the server, allowing an attacker to manipulate the invitation parameters during the request process. By intercepting and modifying a legitimate invitation request, an unauthenticated attacker can assign administrative privileges to a newly invited user without the appropriate authorization checks. A successful exploit results in unauthorized privilege escalation, granting full administrative access to the affected application.https://vulnfeed.org/cve/CVE-2026-121458/https://vulnfeed.org/cve/CVE-2026-121458/Tue, 03 Nov 2026 12:59:17 +0000Instatic before 0.0.21 contains a missing authorization vulnerability in its AI/MCP content read tools that allows low-privileged authenticated users with ai.chat and content.edit.own capabilities to access data rows belonging to other users by calling content_get_document and content_list_documents without the object-level authorization checks enforced by the normal HTTP API. Attackers can use the MCP interface to retrieve private or unpublished draft content and enumerate rows from the posts system table, resulting in cross-user data disclosure.https://vulnfeed.org/cve/CVE-2026-99270/https://vulnfeed.org/cve/CVE-2026-99270/Tue, 03 Nov 2026 12:32:09 +0000In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_handler(). When TCP socket migration fails at inet_ehash_insert() in reqsk_timer_handler(), we jump to the no_ownership: label and free the new reqsk immediately with __reqsk_free(). Thus, we must stop the new reqsk's timer before jumping to the label, but the timer might be missed since the cited commit, resulting in UAF. As we are in the original reqsk's timer context, we can safely call timer_delete_sync() for the new reqsk. Let's pass false to __inet_csk_reqsk_queue_drop() to stop the new reqsk's timer.https://vulnfeed.org/cve/CVE-2026-76124/https://vulnfeed.org/cve/CVE-2026-76124/Tue, 03 Nov 2026 12:31:54 +0000The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 3.2.1 via the send_feedback function. This is due to insufficient file type validation that relies solely on the client-supplied Content-Type header without server-side content inspection or extension validation. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload files that may be executable, which makes remote code execution possible. While uploaded files are deleted after email transmission, a race condition exists during SMTP execution that allows access to the file, and files persist indefinitely when wp_mail() fails.https://vulnfeed.org/cve/CVE-2026-99269/https://vulnfeed.org/cve/CVE-2026-99269/Tue, 03 Nov 2026 11:48:18 +0000In the Linux kernel, the following vulnerability has been resolved: sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs A task can be found on a non-local DSQ while the CPU which dispatched it is still running ops.dequeue() and hasn't cleared SCX_OPSS_DISPATCHING. The DSQ consume and move paths don't wait for the dispatch to finish and can operate on the task concurrently with the dispatcher. Call scx_wait_dispatching() in scx_move_local_task_to_local_dsq(), unlink_dsq_and_switch_rq_lock() and move_task_between_dsqs() before they operate on the task. In scx_move_local_task_to_local_dsq(), wait before scx_resolve_local_dsq() as it may update p->scx.flags.https://vulnfeed.org/cve/CVE-2026-99264/https://vulnfeed.org/cve/CVE-2026-99264/Tue, 03 Nov 2026 11:48:16 +0000In the Linux kernel, the following vulnerability has been resolved: io_uring/net: don't retry recv on uncommitted buffers Commit 41b70df5b38b ("io_uring/net: commit partial buffers on retry") commits ring provided buffers when a receive is going to be retried after a partial transfer, so that another request using the same buffer group can't be handed the memory the first one keeps receiving into. It commits the number of bytes received so far. That does the job for a single buffer which is consumed as a whole, but the request hangs on to all it has mapped: - For a buffer ring with IOU_PBUF_RING_INC only these bytes are consumed. The rest of the buffer stays at the head of the ring. - For a bundle only the buffers which hold these bytes are consumed, the others that were peeked stay in the ring. In both cases the next receive with that buffer group gets memory that the retried request is still going to write to, and whoever comes last overwrites the data of the other. What the retry fills isn't committed at all, as the buffer list isn't known any more at that point. So the kernel hands it out again later on, while the CQE tells the application that it was used, and for an incremental buffer that it is done with. The remainder can't be committed in advance: if the request ends up receiving less, there is no way to tell the application that more was consumed than the CQE accounts for. Complete the request with what it has got instead of retrying it. MSG_WAITALL is no longer honoured for receives into incremental buffers or multi buffer bundles, they can return a short count, with the request marked as failed like for other short MSG_WAITALL transfers.https://vulnfeed.org/cve/CVE-2026-99246/https://vulnfeed.org/cve/CVE-2026-99246/Tue, 03 Nov 2026 11:18:25 +0000In the Linux kernel, the following vulnerability has been resolved: tipc: protect node reset trace dump with node lock The tipc_node_reset_links trace event asks tipc_node_dump() to walk the node's link entries. Unlike the other node events that request link data, this event runs without the node lock. This permits bearer teardown to free a link while the trace callback is dumping it: CPU 0 CPU 1 trace_tipc_node_reset_links() tipc_node_dump() l = n->links[0].link tipc_node_write_lock() kfree(l) n->links[0].link = NULL tipc_node_write_unlock() tipc_link_dump(l) tipc_link_dump() then dereferences the stale pointer. KASAN reported: BUG: KASAN: slab-use-after-free in tipc_link_dump Read of size 4 by task poc/115 Call Trace: tipc_link_dump+0x10cb/0x16b0 tipc_node_dump+0x4bb/0x740 trace_event_raw_event_tipc_node_class+0x258/0x360 tipc_node_reset_links+0x14d/0x1a0 tipc_rcv+0x13f5/0x3030 tipc_udp_recv+0x4e3/0x670 Allocated by task 0: tipc_link_create+0x1e1/0x1020 tipc_node_check_dest+0x7d2/0x11a0 tipc_disc_rcv+0xdbf/0x1430 Freed by task 89: kfree+0x131/0x3c0 tipc_node_link_down+0x267/0x4b0 tipc_node_delete_links+0xec/0x160 bearer_disable+0x107/0x260 Take the node write lock around the trace event. This serializes the dump against tipc_node_link_down(delete=true), which frees the link under the same write lock.