CVE Explorer

Exact snapshot results

353,537 CVE records

CVE ID descending · no relevance ranking

CVE-2026-40933

Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, due to unsafe serialization of stdio commands in the MCP adapter, an authenticated attacker can add an MCP stdio server with an arbitrary command, achieving command execution. The vulnerability lies in a bug in the input sanitization from the “Custom MCP” configuration in http://localhost:3000/canvas - where any user can add a new MCP, when doing so - adding a new MCP using stdio, the user ca

PUBLISHED

Vendor: FlowiseAI, FlowiseAI
Product: flowise-components, Flowise
Provider severity: CRITICAL
Conflicts: 1

CVE-2026-40931

Compressing is a compressing and uncompressing lib for node. Prior to 2.1.1 and 1.10.5, the patch for CVE-2026-24884 relies on a purely logical string validation within the isPathWithinParent utility. This check verifies if a resolved path string starts with the destination directory string but fails to account for the actual filesystem state. By exploiting this "Logical vs. Physical" divergence, an attacker can bypass the security check using a Directory Poisoning technique (pre-existing symbol

PUBLISHED

Vendor: node-modules
Product: compressing
Provider severity: HIGH
Conflicts: 0

CVE-2026-40930

LIBPNG is a reference library for use in applications that process PNG (Portable Network Graphics) raster image files. In version 1.8.0, three inter-frame chunk discard paths in the push-mode APNG parser clear the chunk-header flag without consuming the chunk body and CRC, allowing attacker-controlled bytes inside an ignored ancillary chunk to be reinterpreted as a fresh chunk header on the next call to `png_process_data`. Commit faf06924688b62d7c1654b5ceddedbde66ffadb4 fixes the issue.

PUBLISHED

Vendor: pnggroup, pnggroup
Product: libpng-apng, libpng
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-4093

In the Drupal 7 Term Reference Tree module, two stored XSS vectors exist in the widget/formatter rendering pipeline. Vector A (token display templates): When the Token module is enabled and token display templates are configured, attacker-controlled token output (e.g., term description) is rendered without proper sanitization. Any user who can edit the referenced taxonomy terms can inject HTML/JS that executes when the field is rendered. Vector B (term label rendering): Taxonomy term labels ar

PUBLISHED

Vendor: Drupal
Product: Term Reference Tree
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-40929

WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/commentDelete.json.php` is a state-mutating JSON endpoint that deletes comments but performs no CSRF validation. It does not call `forbidIfIsUntrustedRequest()`, does not verify a CSRF/global token, and does not check `Origin`/`Referer`. Because AVideo intentionally sets `session.cookie_samesite=None` (to support cross-origin embed players), a cross-site request from any attacker-controlled page automatically carr

PUBLISHED

Vendor: WWBN
Product: AVideo
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-40928

WWBN AVideo is an open source video platform. In versions 29.0 and prior, multiple AVideo JSON endpoints under `objects/` accept state-changing requests via `$_REQUEST`/`$_GET` and persist changes tied to the caller's session user, without any anti-CSRF token, origin check, or referer check. A malicious page visited by a logged-in victim can silently cast/flip the victim's like/dislike on any comment (`objects/comments_like.json.php`), post a comment authored by the victim on any video, with att

PUBLISHED

Vendor: WWBN
Product: AVideo
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-40927

Docmost is open-source collaborative wiki and documentation software. Prior to 0.80.0, when leaving a comment on a page, it is possible to include a JavaScript URI as the link. When a user clicks on the link the JavaScript executes. This vulnerability is fixed in 0.80.0.

PUBLISHED

Vendor: docmost
Product: docmost
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-40926

WWBN AVideo is an open source video platform. In versions 29.0 and prior, three admin-only JSON endpoints — `objects/categoryAddNew.json.php`, `objects/categoryDelete.json.php`, and `objects/pluginRunUpdateScript.json.php` — enforce only a role check (`Category::canCreateCategory()` / `User::isAdmin()`) and perform state-changing actions against the database without calling `isGlobalTokenValid()` or `forbidIfIsUntrustedRequest()`. Peer endpoints in the same directory (`pluginSwitch.json.php`, `p

PUBLISHED

Vendor: WWBN
Product: AVideo
Provider severity: HIGH
Conflicts: 0

CVE-2026-40925

WWBN AVideo is an open source video platform. In versions 29.0 and prior, `objects/configurationUpdate.json.php` (also routed via `/updateConfig`) persists dozens of global site settings from `$_POST` but protects the endpoint only with `User::isAdmin()`. It does not call `forbidIfIsUntrustedRequest()`, does not verify a `globalToken`, and does not validate the Origin/Referer header. Because AVideo intentionally sets `session.cookie_samesite=None` to support cross-origin iframe embedding, a logg

PUBLISHED

Vendor: WWBN
Product: AVideo
Provider severity: HIGH
Conflicts: 0

CVE-2026-40924

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, the HTTP resolver's FetchHttpResource function calls io.ReadAll(resp.Body) with no response body size limit. Any tenant with permission to create TaskRuns or PipelineRuns that reference the HTTP resolver can point it at an attacker-controlled HTTP server that returns a very large response body within the 1-minute timeou

PUBLISHED

Vendor: tektoncd
Product: pipeline
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-40923

Tekton Pipelines project provides k8s-style resources for declaring CI/CD-style pipelines. Starting in version 1.0.0 and prior to versions 1.0.2, 1.3.4, 1.6.2, 1.9.3, and 1.11.1, a validation bypass in the VolumeMount path restriction allows mounting volumes under restricted /tekton/ internal paths by using .. path traversal components. The restriction check uses strings.HasPrefix without filepath.Clean, so a path like /tekton/home/../results passes validation but resolves to /tekton/results at

PUBLISHED

Vendor: tektoncd
Product: pipeline
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-40922

SiYuan is an open-source personal knowledge management system. In versions 3.6.1 through 3.6.3, a prior fix for XSS in bazaar README rendering (incomplete fix for CVE-2026-33066) enabled the Lute HTML sanitizer, but the sanitizer does not block iframe tags, and its URL-prefix blocklist does not effectively filter srcdoc attributes which contain raw HTML rather than URLs. A malicious bazaar package author can include an iframe with a srcdoc attribute containing embedded scripts in their README. W

PUBLISHED

Vendor: siyuan-note
Product: siyuan
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-4092

Path Traversal in Clasp impacting versions < 3.2.0 allows a remote attacker to perform remote code execution via a malicious Google Apps Script project containing specially crafted filenames with directory traversal sequences.

PUBLISHED

Vendor: Google
Product: Clasp
Provider severity: HIGH
Conflicts: 0

CVE-2026-40919

A flaw was found in GIMP. This vulnerability, a buffer overflow in the `file-seattle-filmworks` plugin, can be exploited when a user opens a specially crafted Seattle Filmworks file. A remote attacker could leverage this to cause a denial of service (DoS), leading to the plugin crashing and potentially impacting the stability of the GIMP application.

PUBLISHED

Vendor: Red Hat, Red Hat, Red Hat, Red Hat
Product: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-40918

A flaw was found in GIMP. Processing a specially crafted PVR image file with large dimensions can lead to a denial of service (DoS). This occurs due to a stack-based buffer overflow and an out-of-bounds read in the PVR image loader, causing the application to crash. Systems that process untrusted PVR image files are affected.

PUBLISHED

Vendor: Red Hat, Red Hat, Red Hat, Red Hat
Product: Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-40917

A flaw was found in GIMP. This vulnerability, a heap buffer over-read in the `icns_slurp()` function, occurs when processing specially crafted ICNS image files. An attacker could provide a malicious ICNS file, potentially leading to application crashes or information disclosure on systems that process such files.

PUBLISHED

Vendor: Red Hat, Red Hat, Red Hat, Red Hat
Product: Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-40916

A flaw was found in GIMP. A stack buffer overflow vulnerability in the TIM image loader's 4BPP decoding path allows a local user to cause a Denial of Service (DoS). By opening a specially crafted TIM image file, the application crashes due to an unconditional overflow when writing to a variable-length array.

PUBLISHED

Vendor: Red Hat, Red Hat, Red Hat, Red Hat
Product: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-40915

A flaw was found in GIMP. A remote attacker could exploit an integer overflow vulnerability in the FITS image loader by providing a specially crafted FITS file. This integer overflow leads to a zero-byte memory allocation, which is then subjected to a heap buffer overflow when processing pixel data. Successful exploitation could result in a denial of service (DoS) or potentially arbitrary code execution.

PUBLISHED

Vendor: Red Hat, Red Hat, Red Hat, Red Hat
Product: Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 6
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-40914

A vulnerability exists in Apache Artemis whereby an application using the STOMP protocol with security credentials that grant either the consume or send permission on an address can augment the routing-type supported by that address even if said user doesn't have the createAddress permission for that particular address. A user could successfully send a message to an address or consume a message from a queue with a routing-type not supported by the corresponding address when that operation should

PUBLISHED

Vendor: Apache Software Foundation, Apache Software Foundation
Product: Apache ActiveMQ Artemis Stomp Protocol, Apache Artemis Stomp Protocol
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-40912

Traefik is an HTTP reverse proxy and load balancer. Prior to versions 2.11.43, 3.6.14, and 3.7.0-rc.2, there is a high severity authentication bypass vulnerability in Traefik's StripPrefixRegex middleware when used in combination with ForwardAuth, BasicAuth, or DigestAuth. The middleware matches the regex against the decoded URL path but uses the resulting byte length to slice the percent-encoded raw path. When a dot (or multiple dots) appears in the prefix portion of the URL, the raw path after

PUBLISHED

Vendor: Red Hat, traefik
Product: Red Hat OpenShift Dev Spaces 3.28, traefik
Provider severity: HIGH
Conflicts: 3

CVE-2026-40911

WWBN AVideo is an open source video platform. In versions 29.0 and prior, the YPTSocket plugin's WebSocket server relays attacker-supplied JSON message bodies to every connected client without sanitizing the `msg` or `callback` fields. On the client side, `plugin/YPTSocket/script.js` contains two `eval()` sinks fed directly by those relayed fields (`json.msg.autoEvalCodeOnHTML` at line 568 and `json.callback` at line 95). Because tokens are minted for anonymous visitors and never revalidated bey

PUBLISHED

Vendor: WWBN
Product: AVideo
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-40910

frp is a fast reverse proxy. From 0.43.0 to 0.68.0, frp contains an authentication bypass in the HTTP vhost routing path when routeByHTTPUser is used as part of access control. In proxy-style requests, the routing logic uses the username from Proxy-Authorization to select the routeByHTTPUser backend, while the access control check uses credentials from the regular Authorization header. As a result, an attacker who can reach the HTTP vhost entrypoint and knows or can guess the protected routeByHT

PUBLISHED

Vendor: fatedier
Product: frp
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-4091

The OPEN-BRAIN plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 0.5.0. This is due to missing nonce verification on the settings form in the func_page_main() function. This makes it possible for unauthenticated attackers to inject malicious web scripts via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

PUBLISHED

Vendor: faridsaniee
Product: OPEN-BRAIN
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-40909

WWBN AVideo is an open source video platform. In versions 29.0 and prior, the locale save endpoint (`locale/save.php`) constructs a file path by directly concatenating `$_POST['flag']` into the path at line 30 without any sanitization. The `$_POST['code']` parameter is then written verbatim to that path via `fwrite()` at line 40. An admin attacker (or any user who can CSRF an admin, since no CSRF token is checked and cookies use `SameSite=None`) can traverse out of the `locale/` directory and wr

PUBLISHED

Vendor: WWBN
Product: AVideo
Provider severity: HIGH
Conflicts: 0

CVE-2026-40908

WWBN AVideo is an open source video platform. In versions 29.0 and prior, the file `git.json.php` at the web root executes `git log -1` and returns the full output as JSON to any unauthenticated user. This exposes the exact deployed commit hash (enabling version fingerprinting against known CVEs), developer names and email addresses (PII), and commit messages which may contain references to internal systems or security fixes. As of time of publication, no known patched versions are available.

PUBLISHED

Vendor: WWBN
Product: AVideo
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-40907

WWBN AVideo is an open source video platform. In versions 29.0 and prior, the endpoint `plugin/Live/view/Live_restreams/list.json.php` contains an Insecure Direct Object Reference (IDOR) vulnerability that allows any authenticated user with streaming permission to retrieve other users' live restream configurations, including third-party platform stream keys and OAuth tokens (access_token, refresh_token) for services like YouTube Live, Facebook Live, and Twitch. Commit d5992fff2811df4adad1d9fc7d0

PUBLISHED

Vendor: WWBN
Product: AVideo
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-40906

Electric is a Postgres sync engine. From 1.1.12 to before 1.5.0, the order_by parameter in the ElectricSQL /v1/shape API is vulnerable to error-based SQL injection, allowing any authenticated user to read, write, and destroy the full contents of the underlying PostgreSQL database through crafted ORDER BY expressions. This vulnerability is fixed in 1.5.0.

PUBLISHED

Vendor: electric-sql, Red Hat
Product: electric, Red Hat Developer Hub
Provider severity: CRITICAL, HIGH
Conflicts: 3

CVE-2026-40905

LinkAce is a self-hosted archive to collect website links. Prior to 2.5.4, a password reset poisoning vulnerability was identified in the application due to improper trust of user-controlled HTTP headers. The application uses the X-Forwarded-Host header when generating password reset URLs. By manipulating this header during a password reset request, an attacker can inject an attacker-controlled domain into the reset link sent via email. As a result, the victim receives a password reset email con

PUBLISHED

Vendor: Kovah
Product: LinkAce
Provider severity: HIGH
Conflicts: 0

CVE-2026-40904

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew exposes multiple dataset and dataRequest endpoints that authorize low-privileged project members at the team level instead of binding the requested dataset_id, dataRequest id, and connection_id to the caller's allowed projects. An authenticated attacker who only has access to one project inside a team can read, execute, create, update, and del

PUBLISHED

Vendor: chartbrew
Product: chartbrew
Provider severity: HIGH
Conflicts: 0

CVE-2026-40903

goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.6, goshs has an ArtiPACKED vulnerability. ArtiPACKED can lead to leakage of the GITHUB_TOKEN through workflow artifacts, even though the token is not present in the repository source code. This vulnerability is fixed in 2.0.0-beta.6.

PUBLISHED

Vendor: patrickhener
Product: goshs
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-40902

PhpSpreadsheet is a pure PHP library for reading and writing spreadsheet files. Prior to 1.30.4, 2.1.16, 2.4.5, 3.10.5, and 5.7.0, the XLSX reader's ColumnAndRowAttributes::readRowAttributes() method reads row numbers from XML attributes without validating them against the spreadsheet maximum row limit (AddressRange::MAX_ROW = 1,048,576). An attacker can craft a minimal XLSX file (~1.6KB) containing a <row r="999999999"/> element that inflates cachedHighestRow to 999,999,999, causing any subsequ

PUBLISHED

Vendor: PHPOffice
Product: PhpSpreadsheet
Provider severity: HIGH
Conflicts: 0

CVE-2026-40901

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below ship the legacy velocity-1.7.jar, which pulls in commons-collections-3.2.1.jar containing the InvokerTransformer deserialization gadget chain. Quartz 2.3.2, also bundled in the application, deserializes job data BLOBs from the qrtz_job_details table using ObjectInputStream with no deserialization filter or class allowlist. An authenticated attacker who can write to the Quartz job table, such as throu

PUBLISHED

Vendor: dataease
Product: dataease
Provider severity: HIGH
Conflicts: 0

CVE-2026-40900

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a SQL injection vulnerability in the /de2api/datasetData/previewSql endpoint. The user-supplied SQL is wrapped in a subquery without validation that the input is a single SELECT statement. Combined with the JDBC blocklist bypass that allows enabling allowMultiQueries=true, an attacker can break out of the subquery and execute arbitrary stacked SQL statements, including UPDATE and other write

PUBLISHED

Vendor: dataease
Product: dataease
Provider severity: HIGH
Conflicts: 0

CVE-2026-4090

The Inquiry Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.4.2. This is due to missing nonce verification in the rd_ic_settings_page function when processing settings form submissions. This makes it possible for unauthenticated attackers to update the plugin's settings, including injecting malicious scripts that will be stored and executed in the admin area, via a forged request granted they can trick an administrator into performing

PUBLISHED

Vendor: ravster
Product: Inquiry cart
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-40899

DataEase is an open-source data visualization and analytics platform. Versions 2.10.20 and below contain a JDBC parameter blocklist bypass vulnerability in the MySQL datasource configuration. The Mysql class uses Lombok's @Data annotation, which auto-generates a public setter for the illegalParameters field that contains the JDBC security blocklist. When a datasource configuration is submitted as JSON, Jackson deserialization calls setIllegalParameters with an attacker-supplied empty list, repla

PUBLISHED

Vendor: dataease
Product: dataease
Provider severity: HIGH
Conflicts: 0

CVE-2026-40898

quic-go is an implementation of the QUIC protocol in Go. Prior to version 0.59.1, an attacker can cause excessive memory allocation in quic-go's HTTP/3 client and server implementations by sending a QPACK-encoded HEADERS frame that decodes into a large trailer field section with many unique field names and/or large values. The implementation builds an `http.Header` for the corresponding `http.Request` or `http.Response`, while only enforcing limits on the size of the QPACK-compressed HEADERS fra

PUBLISHED

Vendor: quic-go
Product: quic-go
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-40897

Math.js is an extensive math library for JavaScript and Node.js. From 13.1.1 to before 15.2.0, a vulnerability allowed executing arbitrary JavaScript via the expression parser of mathjs. You can be affected when you have an application where users can evaluate arbitrary expressions using the mathjs expression parser. This vulnerability is fixed in 15.2.0.

PUBLISHED

Vendor: Red Hat, Red Hat, Red Hat, Red Hat, josdejong, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product: Red Hat OpenShift AI (RHOAI), Red Hat Developer Hub, Red Hat OpenShift Container Platform 4, Self-service automation portal 2, mathjs, Red Hat Enterprise Linux 9, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 8
Provider severity: HIGH
Conflicts: 2

CVE-2026-40896

OpenProject is open-source, web-based project management software. Prior to version 17.3.0, a user with `manage_agendas` permission in any project can inject agenda items into meetings belonging to any other project on the instance — even projects they have no access to. No knowledge of the target project, meeting, or victim is required; the attacker can blindly spray items into every meeting on the instance by iterating sequential section IDs. Version 17.3.0 patches the issue.

PUBLISHED

Vendor: opf
Product: openproject
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-40895

follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. Prior to 1.16.0, when an HTTP request follows a cross-domain redirect (301/302/307/308), follow-redirects only strips authorization, proxy-authorization, and cookie headers (matched by regex at index.js). Any custom authentication header (e.g., X-API-Key, X-Auth-Token, Api-Key, Token) is forwarded verbatim to the redirect target. This vulnerability is fixed in 1.16.

PUBLISHED

Vendor: Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, follow-redirects, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product: OpenShift Pipelines, Red Hat OpenShift Container Platform 4, Migration Toolkit for Applications 8, Red Hat OpenShift GitOps, Red Hat OpenShift Service Mesh 3.0, Red Hat OpenShift AI 3.3, Red Hat OpenShift Dev Spaces 3.28, Red Hat OpenShift Container Platform 4.21, Red Hat 3scale API Management Platform 2, Red Hat Ansible Automation Platform 2, Red Hat OpenShift Container Platform 4.19, Red Hat Ceph Storage 9, Red Hat Edge Manager 1, OpenShift Service Mesh 3, Red Hat OpenShift distributed tracing 3, Red Hat Advanced Cluster Security for Kubernetes 4.10, Red Hat OpenShift Container Platform 4.2, Red Hat 3scale API Management Platform 2, multicluster engine for Kubernetes 2.1, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4.22, Red Hat Ansible Automation Platform 2, Red Hat Hardened Images, Cluster Observability Operator 1.5.0, Migration Toolkit for Virtualization, Red Hat Edge Manager 1, Migration Toolkit for Applications 8, Network Observability (NETOBSERV) 1.11.1, Red Hat OpenShift Service Mesh 3.3, Cryostat 4 on RHEL 9, Red Hat Enterprise Linux AI (RHEL AI) 3, OpenShift Lightspeed, Red Hat Advanced Cluster Management for Kubernetes 2.14, Red Hat OpenShift Service Mesh 3.2, Cluster Observability Operator 1.5.0, Red Hat Ansible Automation Platform 2, Red Hat build of Apicurio Registry 2, Red Hat OpenShift AI (RHOAI), Self-service automation portal 2, Red Hat Discovery 2, Red Hat OpenShift AI (RHOAI), Red Hat Advanced Cluster Security 4.9, Red Hat Satellite 6, Red Hat OpenShift Virtualization 4, Red Hat Satellite 6, Cryostat 4, Network Observability (NETOBSERV) 1.11.1, Node HealthCheck Operator, Red Hat OpenShift Dev Spaces 3.28, OpenShift Service Mesh 3, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift GitOps, OpenShift Lightspeed, Red Hat OpenShift AI (RHOAI), Red Hat Developer Hub 1.9, Red Hat OpenShift AI 3.3, Red Hat build of Apicurio Registry 3, Red Hat Ansible Automation Platform 2.5, Red Hat Fuse 7, Red Hat Trusted Profile Analyzer, OpenShift Pipelines, Node HealthCheck Operator, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), multicluster engine for Kubernetes 2.8, Red Hat Ansible Automation Platform 2, Red Hat Edge Manager 1, multicluster engine for Kubernetes 2.6, Red Hat OpenShift AI 2.25, Red Hat OpenShift AI (RHOAI), Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat Ansible Automation Platform 2, Red Hat Quay 3.14, Red Hat Data Grid 8, Red Hat Ansible Automation Platform 2, Red Hat OpenShift Service Mesh 3.0, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat Enterprise Linux AI (RHEL AI) 3, Red Hat Hardened Images, Red Hat Ansible Automation Platform 2, Red Hat Quay 3.9, Red Hat Edge Manager 1, Red Hat OpenShift Container Platform 4.2, Red Hat Build of Podman Desktop - Tech Preview, Red Hat build of Apicurio Registry 3, Gatekeeper 3, Red Hat OpenShift Container Platform 4.21, Red Hat Advanced Cluster Management for Kubernetes 2.16, Red Hat Openshift Data Foundation 4, Red Hat OpenShift AI (RHOAI), Red Hat JBoss Enterprise Application Platform 8, Red Hat JBoss Enterprise Application Platform Expansion Pack, OpenShift Pipelines, multicluster engine for Kubernetes 2.9, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Service Mesh 3.3, Red Hat 3scale API Management Platform 2, Red Hat Build of Podman Desktop, Red Hat Satellite 6, Red Hat JBoss Enterprise Application Platform 7, Red Hat Advanced Cluster Management for Kubernetes 2.15, Red Hat Enterprise Linux 8, Red Hat Migration Toolkit 1.8, Red Hat OpenShift Dev Spaces 3.28, Red Hat OpenShift Service Mesh 2.6, Red Hat Ansible Automation Platform 2, Migration Toolkit for Virtualization, Red Hat build of Apache Camel - HawtIO 4, multicluster engine for Kubernetes 2.11, Red Hat Quay 3.1, Red Hat OpenShift AI (RHOAI), streams for Apache Kafka 2, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4.19, Red Hat OpenShift AI 2.25, Red Hat Quay 3.17, Red Hat OpenShift Service Mesh 3.2, Red Hat Quay 3.15, Red Hat OpenShift AI (RHOAI), Red Hat 3scale API Management Platform 2, Red Hat Ansible Automation Platform 2, OpenShift Pipelines, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Container Platform 4, Red Hat OpenShift Container Platform 4, Node HealthCheck Operator, Red Hat OpenShift Service Mesh 3.1, Red Hat Developer Hub, Red Hat Connectivity Link 1, Red Hat Trusted Artifact Signer, Red Hat OpenShift Service Mesh 3.1, streams for Apache Kafka 3, Red Hat Openshift Data Foundation 4, Red Hat 3scale API Management Platform 2, Red Hat OpenShift Container Platform 4, Red Hat Quay 3.12, Red Hat Ansible Automation Platform 2, Red Hat OpenShift AI (RHOAI), Red Hat Openshift Data Foundation 4, follow-redirects, Red Hat OpenShift AI (RHOAI), Red Hat Enterprise Linux 9, Red Hat OpenShift Virtualization 4, Cluster Observability Operator 1.5.0, Red Hat OpenShift Container Platform 4, Red Hat OpenShift AI (RHOAI), Red Hat Enterprise Linux 8, Red Hat Process Automation 7, Red Hat Ansible Automation Platform 2, Cryostat 4, Red Hat OpenShift AI (RHOAI), OpenShift Lightspeed, Red Hat Quay 3.16, Red Hat OpenShift Service Mesh 2.6, Red Hat Enterprise Linux 9, Red Hat Developer Hub 1.8, Red Hat OpenShift Dev Spaces 3.28, Cluster Observability Operator 1.5.0, Red Hat Hardened Images, Red Hat OpenShift AI 3.3
Provider severity: HIGH, MEDIUM
Conflicts: 3

CVE-2026-40894

OpenTelemetry dotnet is a dotnet telemetry framework. In OpenTelemetry.Api 0.5.0-beta.2 to 1.15.2 and OpenTelemetry.Extensions.Propagators 1.3.1 to 1.15.2, The implementation details of the baggage, B3 and Jaeger processing code in the OpenTelemetry.Api and OpenTelemetry.Extensions.Propagators NuGet packages can allocate excessive memory when parsing which could create a potential denial of service (DoS) in the consuming application. This vulnerability is fixed in 1.15.3.

PUBLISHED

Vendor: open-telemetry, open-telemetry, open-telemetry
Product: opentelemetry-dotnet, OpenTelemetry.Api, OpenTelemetry.Extensions.Propagators
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-40893

Gotenberg is a Docker-powered stateless API for PDF files. Prior to 8.31.0, Gotenberg only checks if the tag is exactly FileName, so System:FileName slips right through and ExifTool happily renames the file. This allows remote attackers to move, rename, and change permissions for arbitrary files. This vulnerability is fixed in 8.31.0.

PUBLISHED

Vendor: gotenberg
Product: gotenberg
Provider severity: HIGH
Conflicts: 1

CVE-2026-40892

PJSIP is a free and open source multimedia communication library written in C. In 2.16 and earlier, a stack buffer overflow exists in pjsip_auth_create_digest2() in PJSIP when using pre-computed digest credentials (PJSIP_CRED_DATA_DIGEST). The function copies credential data using cred_info->data.slen as the length without an upper-bound check, which can overflow the fixed-size ha1 stack buffer (128 bytes) if data.slen exceeds the expected digest string length.

PUBLISHED

Vendor: pjsip
Product: pjproject
Provider severity: HIGH
Conflicts: 0

CVE-2026-40891

OpenTelemetry dotnet is a dotnet telemetry framework. From 1.13.1 to before 1.15.2, When exporting telemetry over gRPC using the OpenTelemetry Protocol (OTLP), the exporter may parse a server-provided grpc-status-details-bin trailer during retry handling. Prior to the fix, a malformed trailer could encode an extremely large length-delimited protobuf field which was used directly for allocation, allowing excessive memory allocation and potential denial of service (DoS). This vulnerability is fixe

PUBLISHED

Vendor: open-telemetry, open-telemetry
Product: opentelemetry-dotnet, OpenTelemetry.Exporter.OpenTelemetryProtocol
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-40890

The package `github.com/gomarkdown/markdown` is a Go library for parsing Markdown text and rendering as HTML. Processing a malformed input containing a < character that is not followed by a > character anywhere in the remaining text with a SmartypantsRenderer will lead to Out of Bounds read or a panic. This vulnerability is fixed with commit 759bbc3e32073c3bc4e25969c132fc520eda2778.

PUBLISHED

Vendor: gomarkdown
Product: markdown
Provider severity: HIGH
Conflicts: 0

CVE-2026-4089

The Twittee Text Tweet plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' shortcode attribute in all versions up to and including 1.0.8. This is due to insufficient input sanitization and output escaping on user-supplied shortcode attributes. The ttt_twittee_tweeter() function uses extract() to pull shortcode attributes into local variables and then directly concatenates them into HTML output without any escaping. Specifically, the $id parameter is inserted into an HT

PUBLISHED

Vendor: johnnie2u
Product: Twittee Text Tweet
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-40889

Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.2 and 16.4.2, authenticated users can access unauthorized files by exploiting certain api endpoint. Versions 15.58.2 and 16.4.2 contain a patch. No known workarounds are available.

PUBLISHED

Vendor: frappe
Product: hrms
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-40888

Frappe HR is an open-source human resources management solution (HRMS). Prior to versions 15.58.1 and 16.4.1, an authenticated user with default role can access unauthorized information by exploiting certain api endpoint. Versions 15.58.1 and 16.4.1 contain a patch. No known workarounds are available.

PUBLISHED

Vendor: frappe
Product: hrms
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-40887

Vendure is an open-source headless commerce platform. Starting in version 1.7.4 and prior to versions 2.3.4, 3.5.7, and 3.6.2, an unauthenticated SQL injection vulnerability exists in the Vendure Shop API. A user-controlled query string parameter is interpolated directly into a raw SQL expression without parameterization or validation, allowing an attacker to execute arbitrary SQL against the database. This affects all supported database backends (PostgreSQL, MySQL/MariaDB, SQLite). The Admin AP

PUBLISHED

Vendor: vendurehq
Product: vendure
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-40886

A flaw was found in Argo Workflows, an open-source system for managing tasks in Kubernetes. An attacker with appropriate permissions can trigger a system-wide crash by submitting a specially crafted workflow pod with a malformed annotation. This vulnerability leads to a persistent Denial of Service (DoS), preventing all workflow processing until manual intervention removes the poisoned pod.

PUBLISHED

Vendor: Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, argoproj, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product: Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), argo-workflows, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI)
Provider severity: HIGH
Conflicts: 2

CVE-2026-40885

goshs is a SimpleHTTPServer written in Go. From 2.0.0-beta.4 to 2.0.0-beta.5, goshs leaks file-based ACL credentials through its public collaborator feed when the server is deployed without global basic auth. Requests to .goshs-protected folders are logged before authorization is enforced, and the collaborator websocket broadcasts raw request headers, including Authorization. An unauthenticated observer can capture a victim's folder-specific basic-auth header and replay it to read, upload, overw

PUBLISHED

Vendor: patrickhener
Product: goshs
Provider severity: HIGH
Conflicts: 0