Security

Ansible-operator-plugins: ansible operator plugins: arbitrary code execution via jinja2 template injection

cve-program ·

https://catalog.redhat.com/software/containers/: ansible-automation-platform-26/lightspeed-rhel9-operator · https://catalog.redhat.com/software/containers/: ansible-automation-platform-27/lightspeed-rhel9-operator · https://catalog.redhat.com/software/containers/: openshift-service-mesh/kiali-rhel9-operator

Simple User Management - Moderately critical - Access bypass - SA-CONTRIB-2026-239

cve-program ·

https://www.drupal.org/project/simple_user_management: Simple User Management

oapi-codegen: OpenAPI Server Description Escapes Generated Go Comment and Injects Executable Code

osv · GO-2026-6016

Go: github.com/oapi-codegen/oapi-codegen/v2

Out-of-bounds zero-length stream writes can panic

osv · CVE-2026-119143 · GHSA-93g3-36p8-x2gc

crates.io: wasmtime

Wasmtime may not properly enforce async-entrypoint requirement

osv · CVE-2026-119136 · GHSA-vcg5-q8m5-8379

crates.io: wasmtime

`wasi-http`: Request with long url before query parameter crashes host

osv · CVE-2026-119131 · GHSA-w36r-2hch-9xp9

crates.io: wasmtime-wasi-http

Stack overflow dropping a long chain of recursive types

osv · CVE-2026-119137 · GHSA-wjc8-633q-pwxr

crates.io: wasmtime

Panic on erroneous call-to-host from guest realloc call

osv · CVE-2026-119141 · GHSA-7v24-42x9-pxf7

crates.io: wasmtime

Panic viewing component model stream or future as the wrong type

osv · CVE-2026-119135 · GHSA-63h4-6cx9-pjfj

crates.io: wasmtime

Overlapping string transcode in a fused adapter can panic

osv · CVE-2026-119132 · GHSA-54p9-vhhq-8f7q

crates.io: wasmtime

Component-model handle tables are capped only per instance and charged to no limit

osv · CVE-2026-119134 · GHSA-q554-3cjc-rx7p

crates.io: wasmtime

Panic when pending calls are run after a trap

osv · CVE-2026-119138 · GHSA-hmwq-g22x-qjw5

crates.io: wasmtime

Exception tags can cause host data structures to be unaligned

osv · CVE-2026-119133 · GHSA-p79w-pv2r-29qp

crates.io: wasmtime

Panic when invoking an async-lifted function via `call`

osv · CVE-2026-119139 · GHSA-m6w2-jwq2-cv2c

crates.io: wasmtime

Host panic when component `call_async` is cancelled under some conditions

osv · CVE-2026-119142 · GHSA-3r89-v5mq-j5xf

crates.io: wasmtime

Guests can send absolute-form HTTP requests to different hosts

osv · CVE-2026-119130 · GHSA-5qpp-g3j2-8frx

crates.io: wasmtime-wasi-http

Yielding in a component start function can lead to a host panic

osv · CVE-2026-119140 · GHSA-5hhx-4wrr-3j9g

crates.io: wasmtime

In mtee, there is a possible escalation of privilege due to a missing bounds check. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploita…

cve-program ·

Vendor product: MediaTek chipset

In mtee, there is a possible escalation of privilege due to type confusion. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Pa…

cve-program ·

Vendor product: MediaTek chipset

In vdec, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch …

cve-program ·

Vendor product: MediaTek chipset

In venc, there is a possible out of bounds write due to type confusion. This could lead to local escalation of privilege if a malicious actor has already obtained the System privilege. User interaction is not needed for exploitation. Patch …

cve-program ·

Vendor product: MediaTek chipset

In vdec, there is a possible out of bounds write due to a missing bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation. Patch ID: ALPS113…

cve-program ·

Vendor product: MediaTek chipset

In Telephony, there is a possible information disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Pat…

cve-program ·

Vendor product: MediaTek chipset

SQLite before 3.53.2 Out-of-Bounds Read in FTS5 fts5LeafSeek

cve-program ·

https://sqlite.org/: SQLite

PDF Invoices & Packing Slips for WooCommerce <= 5.14.0 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Disclosure via 'order_id' Shortcode Attribute

cve-program ·

Vendor product: PDF Invoices & Packing Slips for WooCommerce

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Rubygem-katello: katello: katello: katello docker tags repositories api cross-organization authorization bypass

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: ctags · https://access.redhat.com/downloads/content/package-browser/: rubygem-katello

Ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure of postgresql data via insecure backup permissions

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: ansible-collection-redhat-leapp · https://access.redhat.com/downloads/content/package-browser/: ansible-collection-redhat-leapp

Ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure via leapp report tampering

cve-program ·

https://access.redhat.com/downloads/content/package-browser/: ansible-collection-redhat-leapp · https://access.redhat.com/downloads/content/package-browser/: ansible-collection-redhat-leapp

Nodemailer before 8.0.4 is vulnerable to SMTP command injection through the unsanitized envelope.size parameter. When an application passes a custom envelope object with a size property containing CRLF characters to sendMail(), the value is…

nvd ·

CodeWhale versions >= 0.3.27 and < 0.8.64 (published as deepseek-tui >= 0.3.27 and < 0.8.41 on npm and 0.3.27 through 0.8.41 on crates.io, and as codewhale / codewhale-tui >= 0.8.41 and < 0.8.64) contain an argument injection vulnerability …

nvd ·

CodeWhale versions >= 0.3.10 and < 0.8.64 (published as deepseek-tui >= 0.3.10 and < 0.8.41 on npm and 0.3.10 through 0.8.41 on crates.io, and as codewhale / codewhale-tui >= 0.8.41 and < 0.8.64) contain a vulnerability in the exec_shell_in…

nvd ·

SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4-alpha.3) contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint. The route…

nvd ·

actix-http versions before 3.12.1 contain an HTTP request smuggling vulnerability in the HTTP/1.1 parser that accepts requests with both Content-Length and Transfer-Encoding: chunked headers. Unauthenticated remote attackers can exploit thi…

nvd ·

The actix-files crate (actix_files) before version 0.6.10 contains an information exposure vulnerability. When a non-existing folder is passed as the serve_from argument to Files::new(), the mount path defaults to an empty path; the service…

nvd ·

actix-files before 0.6.10 contains a denial of service vulnerability triggered by an empty Range header in GET requests for static files. When panic is set to abort, remote attackers can crash the process on-demand by sending a GET request …

nvd ·

SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier) contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only …

nvd ·

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interpolates user-supplied identifier parameters (channel, function, and trigger names) into SQL statements without proper esc…

nvd ·

n8n before 1.123.67, 2.31.5, and 2.32.1 contains a credential authorization bypass in the HTTP Request node. An authenticated member with edit access to a shared workflow can reference another user's credential while specifying the credenti…

nvd ·

n8n before 2.31.5 and 2.32.x before 2.32.1 contain a path-confinement bypass in the @n8n/computer-use file-search (search_files) tool. A crafted search pattern can bypass the base-directory confinement check and expand to locations outside …

nvd ·

n8n before 2.32.1 (and before 2.31.5) is vulnerable to account takeover via the Token Exchange Embed Login feature. When a validly-signed incoming token was matched to a local account by its email claim, the service did not verify that the …

nvd ·

n8n versions before 2.32.1 fail to enforce the Allowed HTTP Request Domains allowlist in multiple AI and LLM nodes when user-supplied base or endpoint URLs are configured. Low-privileged workflow editors with use-only access to shared crede…

nvd ·

nanoid (Nano ID) before 3.3.16 and 5.1.16 contains an infinite loop in the customAlphabet and nanoid functions of its non-secure module (nanoid/non-secure). When these functions are given a negative size, the loop counter is decremented fro…

nvd ·

DOMPurify before 3.4.7 passes direct references to the module-level DEFAULT_ALLOWED_TAGS and DEFAULT_ALLOWED_ATTR sets to the uponSanitizeElement and uponSanitizeAttribute hooks via data.allowedTags / data.allowedAttributes when sanitize is…

nvd ·

n8n before 2.28.0 (and before 2.27.4 on the 2.27.x branch) registers the DELETE /${restEndpoint}/test-webhook/:id endpoint before authentication middleware is applied, allowing any unauthenticated network caller who knows a workflow ID to c…

nvd ·

ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the TIFF encoder when an invalid tiff:tile-geometry is specified. Supplying malformed tile geometry parameters causes allocated memory not to be released, which can lead to…

nvd ·

ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the ICON decoder that occurs when a memory allocation fails. Processing a crafted ICON file that triggers an allocation failure leaks memory, which may lead to a denial of …

nvd ·

ImageMagick before 7.1.2-26 contains a memory leak vulnerability in the VIFF encoder when memory allocation fails. Attackers can trigger allocation failures by processing specially crafted VIFF images to exhaust available memory and cause d…

nvd ·

ImageMagick before 7.1.2-26 and 6.9.13-51 contains a memory leak in the MIFF encoder that occurs when a memory allocation fails during MIFF image processing, which can lead to denial of service.

nvd ·

ImageMagick before 7.1.2-26 and 6.9.x before 6.9.13-51 contains a memory leak in the YUV decoder that occurs when opening of the blob fails. Repeated triggering can lead to resource exhaustion (denial of service).

nvd ·