Vulnerabilities
LavaLite CMS 10.1.2 High-Severity CVE-2026-113358 Enables Unauthenticated Access to Private Files
An unauthenticated flaw in LavaLite CMS through version 10.1.2 allows attackers to download private files from local or remote storage.
SecOps Signal Advisory Desk
Vulnerabilities
Pillow MIC Parsing Bug: CVE-2026-112390 Causes Infinite Loop in olefile-Enabled Apps
A flaw in the Python imaging library allows crafted files to hang worker threads, requiring an upgrade to version 13.0.0 for resolution.
Vulnerabilities
Craft CMS Authentication Bypass Allows Account Takeover via Code Reuse
A high-severity flaw in Craft CMS versions prior to 5.11.0 lets attackers reuse email verification codes to reset passwords and seize control of user accounts.
Vulnerabilities
aiohttp multipart flaw triggers resource exhaustion; patch CVE-2026-111066 in 3.14.4
Unauthenticated attackers can trigger resource exhaustion in aiohttp versions 2 through 3.14.3 via crafted multipart requests using Request.post().
Vulnerabilities
crewai-tools SSRF vulnerability in SeleniumScrapingTool exposes internal resources via prompt injection
A server-side request forgery vulnerability in crewai-tools allows attackers to access internal resources via the SeleniumScrapingTool component.
Vulnerabilities
Bearer CLI SAST Ranks SQLi and OWASP Flaws by Proximity to Personal Data
The free static analysis tool ranks flaws by proximity to personal data, helping teams prioritize remediation efforts without executing the source code.
Vulnerabilities
Remote DoS in SGLang Scheduler Affects Versions Up to 0.5.19
A high-severity flaw in the SGLang scheduler allows remote denial of service attacks on versions through 0.5.19 while a fix awaits acceptance.
Vulnerabilities
DataBuff ai-apm-web Authentication Bypass Allows Admin Token Forgery
Unauthenticated attackers can forge administrative session tokens using a hardcoded secret in DataBuff ai-apm-web versions up to 0.1.10, granting full access to protected API routes.
Vulnerabilities
Course-Tencent-Cloud Critical SMS Brute-Force Flaw CVE-2026-111675 Affects v2.0.1
A critical vulnerability in the Course-Tencent-Cloud plugin allows unauthenticated attackers to bypass security controls via unlimited SMS verification code attempts.
Vulnerabilities
phpMyFAQ 4.2.0-alpha suffers high-severity resource exhaustion flaw
Unauthenticated API endpoints in phpMyFAQ 4.2.0-alpha allow attackers to crash servers by forcing the application to load all database records into memory.
Vulnerabilities
sshportal AuthZ Bug in Mgmt Shell Lets Non-Admins Grab Decrypted SSH Keys
Authenticated non-admin users can retrieve decrypted backend SSH keys via the management shell, enabling direct access to infrastructure and bypassing security controls.
Vulnerabilities
RIOT OS CoAP Integer Overflow Enables Remote Memory Corruption
An integer overflow in RIOT OS nanocoap allows remote attackers to corrupt memory. The flaw affects versions prior to 2026.07 and is rated critical.
Vulnerabilities
X.Org Server Use-After-Free Bug in Window Handling Leaks Data, Patch Available
A vulnerability in X.Org Server’s window handling allows local attackers to leak sensitive data, though a vendor patch is now available.
Vulnerabilities
Apache Answer 2.0.2 Auth Bypass: Unauth Users View Invite Lists; Update to 2.0.3
A low-severity flaw in Apache Answer versions through 2.0.2 allows unauthorized users to view invited-user lists for non-public questions.
Vulnerabilities
n8n OAuth Endpoint Flaw Allows Unauthenticated Resource Exhaustion in Versions Before 2.41.4
An uncontrolled resource consumption vulnerability in n8n allows attackers to bypass client registration caps and fill disk space via manipulated OAuth identifiers.
Vulnerabilities
Emacs CVE-2026-79992 Fix Incomplete; New CVE-2026-108976 Assigned
An advisory notes the previous patch for an Emacs flaw was incomplete, leading to the assignment of a new CVE identifier for the residual issue.
Vulnerabilities
Eclipse Vert.x Redis Parser Flaw Triggers Massive Memory Allocations, Crashing Event Loops in DoS Attack
A parser flaw in Eclipse Vert.x allows malicious Redis servers to trigger massive memory allocations that crash application event loops and deny service.
Vulnerabilities
FreeRTOS-Plus-TCP Fixes Unauthenticated IPv6 RA Out-of-Bounds Read and Write Flaws in 4.4.1
AWS patches out-of-bounds read and write issues in FreeRTOS-Plus-TCP IPv6 Router Advertisement processing for embedded devices.
Vulnerabilities
Amazon WorkSpaces Skylight Agent Race Condition Allows Local Privilege Escalation
A time-of-check to time-of-use flaw in the Skylight agent lets local users gain SYSTEM rights. AWS advises rebooting Windows WorkSpaces to apply the fix.
Vulnerabilities
Stela Cookie Flaw Enables Full Admin Access Without Credentials
A critical vulnerability in Diaple Stela allows attackers to bypass authentication by manipulating a client-side cookie, granting full administrative control to systems running versions prior to 1.60.1.
Vulnerabilities
SharePoint Server Authenticated Privilege Escalation Flaw Demands Urgent Access Control Review
A high-severity flaw in Microsoft SharePoint Server allows authenticated users to elevate privileges, requiring immediate review of server access controls.
Vulnerabilities
OneNote Mac heap overflow CVE-2026-102858 enables remote code execution for Office 365 and LTSC users
A high-severity flaw in OneNote for Mac allows network-based code execution, exposing users of Office 365 and LTSC versions to remote attacks.
Vulnerabilities
Juniper Junos J-Web Authentication Bypass Enables Remote Root Command Execution
Unauthenticated attackers can execute arbitrary commands with root privileges on exposed Juniper Junos OS J-Web interfaces before specific security releases.
Vulnerabilities
Ivanti VPN: Chained Zero-Days Steal AD Secrets From Patched Gateways
Attackers chain three zero-day flaws to gain root access on patched Ivanti VPN gateways and steal Active Directory secrets.