CVE Explorer

Exact snapshot results

353,537 CVE records

CVE ID descending · no relevance ranking

CVE-2026-23985

A Regular Expression Denial of Service (ReDoS) vulnerability exists in Apache Superset versions 1.5.0 through 5.0.0. The vulnerability is located in the sql_parse.py component, specifically within the SQL_REGEX used for parsing SQL statements in the sqlparse library integration. The affected regular expression contains overlapping disjunctions that share a common outer quantifier. An authenticated attacker can exploit this by sending a maliciously crafted input string (specifically a long sequen

PUBLISHED

Vendor: Apache Software Foundation
Product: Apache Superset
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-23984

An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language (DML) statements (e.g., INSERT, UPDATE, DELETE) on read-only connections, it fails to detect them in specially crafted SQL statements. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrad

PUBLISHED

Vendor: Apache Software Foundation
Product: Apache Superset
Provider severity: HIGH
Conflicts: 0

CVE-2026-23983

A Sensitive Data Exposure vulnerability exists in Apache Superset allowing authenticated users to retrieve sensitive user information. The Tag endpoint (disabled by default) allows users to retrieve a list of objects associated with a specific tag. When these associated objects include Users, the API response improperly serializes and returns sensitive fields, including password hashes (pbkdf2), email addresses, and login statistics. This vulnerability allows authenticated users with low privile

PUBLISHED

Vendor: Apache Software Foundation
Product: Apache Superset
Provider severity: LOW
Conflicts: 0

CVE-2026-23982

An Improper Authorization vulnerability exists in Apache Superset that allows a low-privileged user to bypass data access controls. When creating a dataset, Superset enforces permission checks to prevent users from querying unauthorized data. However, an authenticated attacker with permissions to write datasets and read charts can bypass these checks by overwriting the SQL query of an existing dataset. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to versio

PUBLISHED

Vendor: Apache Software Foundation
Product: Apache Superset
Provider severity: HIGH
Conflicts: 0

CVE-2026-23981

An Improper Authorization vulnerability exists in Apache Superset allowing an authenticated user with permissions to update charts to modify dashboards they do not own. When updating a chart's properties via the REST API, a user can provide a list of dashboard IDs (dashboards) to associate the chart with. The validation logic in the UpdateChartCommand failed to verify that the user had write permissions for the target dashboards specified in the request body. This issue affects Apache Superset

PUBLISHED

Vendor: Apache Software Foundation
Product: Apache Superset
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-23980

Improper Neutralization of Special Elements used in a SQL Command ('SQL Injection') vulnerability in Apache Superset allows an authenticated user with read access to conduct error-based SQL injection via the sqlExpression or where parameters. This issue affects Apache Superset: before 6.0.0. Users are recommended to upgrade to version 6.0.0, which fixes the issue.

PUBLISHED

Vendor: Apache Software Foundation
Product: Apache Superset
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-2398

Authorization bypass through User-Controlled key vulnerability in Adam Retail Automation Ltd. MobilMen 20T allows Privilege Escalation. This issue affects MobilMen 20T: from v3 through 10072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

PUBLISHED

Vendor: Adam Retail Automation Ltd.
Product: MobilMen 20T
Provider severity: HIGH
Conflicts: 0

CVE-2026-23979

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Softwebmedia Gyan Elements gyan-elements allows Reflected XSS.This issue affects Gyan Elements: from n/a through <= 2.2.1.

PUBLISHED

Vendor: Softwebmedia
Product: Gyan Elements
Provider severity: HIGH
Conflicts: 0

CVE-2026-23978

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in Softwebmedia Gyan Elements gyan-elements allows PHP Local File Inclusion.This issue affects Gyan Elements: from n/a through <= 2.2.1.

PUBLISHED

Vendor: Softwebmedia
Product: Gyan Elements
Provider severity: HIGH
Conflicts: 0

CVE-2026-23977

Missing Authorization vulnerability in WPFactory Helpdesk Support Ticket System for WooCommerce support-ticket-system-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Helpdesk Support Ticket System for WooCommerce: from n/a through <= 2.1.2.

PUBLISHED

Vendor: WPFactory
Product: Helpdesk Support Ticket System for WooCommerce
Provider severity: HIGH
Conflicts: 0

CVE-2026-23976

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Chill Modula Image Gallery modula-best-grid-gallery allows Stored XSS.This issue affects Modula Image Gallery: from n/a through <= 2.13.4.

PUBLISHED

Vendor: WP Chill
Product: Modula Image Gallery
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-23975

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in uxper Golo golo allows PHP Local File Inclusion.This issue affects Golo: from n/a through < 1.7.5.

PUBLISHED

Vendor: uxper
Product: Golo
Provider severity: HIGH
Conflicts: 0

CVE-2026-23974

Missing Authorization vulnerability in uxper Golo golo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Golo: from n/a through < 1.7.5.

PUBLISHED

Vendor: uxper
Product: Golo
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-23973

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in uxper Golo golo allows Reflected XSS.This issue affects Golo: from n/a through < 1.7.5.

PUBLISHED

Vendor: uxper
Product: Golo
Provider severity: HIGH
Conflicts: 0

CVE-2026-23972

Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booking and Rental Manager: from n/a through <= 2.6.0.

PUBLISHED

Vendor: magepeopleteam
Product: Booking and Rental Manager
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-23971

Deserialization of Untrusted Data vulnerability in xtemos WoodMart woodmart allows Object Injection.This issue affects WoodMart: from n/a through <= 8.3.8.

PUBLISHED

Vendor: xtemos
Product: WoodMart
Provider severity: HIGH
Conflicts: 0

CVE-2026-23970

Unauthenticated Cross Site Scripting (XSS) in Redirection for Contact Form 7 <= 3.2.8 versions.

PUBLISHED

Vendor: Themeisle
Product: Redirection for Contact Form 7
Provider severity: HIGH
Conflicts: 0

CVE-2026-2397

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Adam Retail Automation Ltd. MobilMen 20T allows SQL Injection. This issue affects MobilMen 20T: from v3 through 10072026. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.

PUBLISHED

Vendor: Adam Retail Automation Ltd.
Product: MobilMen 20T
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-23969

Apache Superset utilizes a configurable dictionary, DISALLOWED_SQL_FUNCTIONS, to restrict the execution of potentially sensitive SQL functions within SQL Lab and charts. While this feature included restrictions for engines like PostgreSQL, a vulnerability was reported where the default list for the ClickHouse engine was incomplete. This issue affects Apache Superset: before 4.1.2. Users are recommended to upgrade to version 4.1.2, which fixes the issue.

PUBLISHED

Vendor: Apache Software Foundation
Product: Apache Superset
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-23968

Copier is a library and CLI app for rendering project templates. Prior to version 9.11.2, Copier suggests that it's safe to generate a project from a safe template, i.e. one that doesn't use unsafe features like custom Jinja extensions which would require passing the `--UNSAFE,--trust` flag. As it turns out, a safe template can currently include arbitrary files/directories outside the local template clone location by using symlinks along with `_preserve_symlinks: false` (which is Copier's defaul

PUBLISHED

Vendor: copier-org
Product: copier
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-23967

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A signature malleability vulnerability exists in the SM2 signature verification logic of the sm-crypto library prior to version 0.3.14. An attacker can derive a new valid signature for a previously signed message from an existing signature. Version 0.3.14 patches the issue.

PUBLISHED

Vendor: JuneAndGreen
Product: sm-crypto
Provider severity: HIGH
Conflicts: 0

CVE-2026-23966

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A private key recovery vulnerability exists in the SM2 decryption logic of sm-crypto prior to version 0.3.14. By interacting with the SM2 decryption interface multiple times, an attacker can fully recover the private key within approximately several hundred interactions. Version 0.3.14 patches the issue.

PUBLISHED

Vendor: JuneAndGreen
Product: sm-crypto
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-23965

sm-crypto provides JavaScript implementations of the Chinese cryptographic algorithms SM2, SM3, and SM4. A signature forgery vulnerability exists in the SM2 signature verification logic of sm-crypto prior to version 0.4.0. Under default configurations, an attacker can forge valid signatures for arbitrary public keys. If the message space contains sufficient redundancy, the attacker can fix the prefix of the message associated with the forged signature to satisfy specific formatting requirements.

PUBLISHED

Vendor: JuneAndGreen
Product: sm-crypto
Provider severity: HIGH
Conflicts: 0

CVE-2026-23964

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, an insecure direct object reference in the web push subscription update endpoint lets any authenticated user update another user's push subscription by guessing or obtaining the numeric subscription id. This can be used to disrupt push notifications for other users and also leaks the web push subscription endpoint. Any user with a web push subscription is impacted, because ano

PUBLISHED

Vendor: mastodon
Product: mastodon
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-23963

Mastodon is a free, open-source social network server based on ActivityPub. Prior to versions 4.5.5, 4.4.12, and 4.3.18, the server does not enforce a maximum length for the names of lists or filters, or for filter keywords, allowing any user to set an arbitrarily long string as the name or keyword. Any local user can abuse the list or filter fields to cause disproportionate storage and computing resource usage. They can additionally cause their own web interface to be unusable, although they mu

PUBLISHED

Vendor: mastodon
Product: mastodon
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-23962

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon versions before v4.3.18, v4.4.12, and v4.5.5 do not have a limit on the maximum number of poll options for remote posts, allowing attackers to create polls with a very large amount of options, greatly increasing resource consumption. Depending on the number of poll options, an attacker can cause disproportionate resource usage in both Mastodon servers and clients, potentially causing Denial of Service either ser

PUBLISHED

Vendor: mastodon
Product: mastodon
Provider severity: HIGH
Conflicts: 0

CVE-2026-23961

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon allows server administrators to suspend remote users to prevent interactions. However, some logic errors allow already-known posts from such suspended users to appear in timelines if boosted. Furthermore, under certain circumstances, previously-unknown posts from suspended users can be processed. This issue allows old posts from suspended users to occasionally end up on timelines on all Mastodon versions. Additi

PUBLISHED

Vendor: mastodon
Product: mastodon
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-23960

A flaw was found in Argo Workflows, an open-source container-native workflow engine for orchestrating parallel jobs on Kubernetes. This stored Cross-Site Scripting (XSS) vulnerability in the artifact directory listing allows any workflow author to execute unauthorized JavaScript code in another user's web browser. This can lead to the compromise of the victim's session and enable an attacker to perform actions with the victim's privileges, potentially resulting in information disclosure or privi

PUBLISHED

Vendor: Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, argoproj, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product: Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), argo-workflows, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI), Red Hat OpenShift AI (RHOAI)
Provider severity: HIGH
Conflicts: 3

CVE-2026-2396

The List View Google Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the event description in all versions up to, and including, 7.4.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level access, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has

PUBLISHED

Vendor: kimipooh
Product: List View Google Calendar
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-23959

CoreShop is a Pimcore enhanced eCommerce solution. An error-based SQL Injection vulnerability was identified in versions prior to 4.1.9 in the `CustomerTransformerController` within the CoreShop admin panel. The affected endpoint improperly interpolates user-supplied input into a SQL query, leading to database error disclosure and potential data extraction. Version 4.1.9 fixes the issue.

PUBLISHED

Vendor: coreshop
Product: CoreShop
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-23958

Dataease is an open source data visualization analysis tool. Prior to version 2.10.19, DataEase uses the MD5 hash of the user’s password as the JWT signing secret. This deterministic secret derivation allows an attacker to brute-force the admin’s password by exploiting unmonitored API endpoints that verify JWT tokens. The vulnerability has been fixed in v2.10.19. No known workarounds are available.

PUBLISHED

Vendor: dataease
Product: dataease
Provider severity: HIGH
Conflicts: 0

CVE-2026-23957

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 1.4.0 and below, overriding encoded array lengths by replacing them with an excessively large value causes the deserialization process to significantly increase processing time. This issue has been fixed in version 1.4.1.

PUBLISHED

Vendor: lxsmnsyc
Product: seroval
Provider severity: HIGH
Conflicts: 0

CVE-2026-23956

seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities. In versions 0.2.0 through 1.4.0, overriding RegExp serialization with extremely large patterns can exhaust JavaScript runtime memory during deserialization. Additionally, overriding RegExp serialization with patterns that trigger catastrophic backtracking can lead to ReDoS (Regular Expression Denial of Service). This issue has been fixed in version 1.4.1.

PUBLISHED

Vendor: lxsmnsyc
Product: seroval
Provider severity: HIGH
Conflicts: 0

CVE-2026-23955

EVerest is an EV charging software stack. Prior to version 2025.9.0, in several places, integer values are concatenated to literal strings when throwing errors. This results in pointers arithmetic instead of printing the integer value as expected, like most of interpreted languages. This can be used by malicious operator to read unintended memory regions, including the heap and the stack. Version 2025.9.0 fixes the issue.

PUBLISHED

Vendor: EVerest
Product: everest-core
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-23954

Incus is a system container and virtual machine manager. Versions 6.21.0 and below allow a user with the ability to launch a container with a custom image (e.g a member of the ‘incus’ group) to use directory traversal or symbolic links in the templating functionality to achieve host arbitrary file read, and host arbitrary file write. This ultimately results in arbitrary command execution on the host. When using an image with a metadata.yaml containing templates, both the source and target paths

PUBLISHED

Vendor: lxc
Product: incus
Provider severity: HIGH
Conflicts: 0

CVE-2026-23953

Incus is a system container and virtual machine manager. In versions 6.20.0 and below, a user with the ability to launch a container with a custom YAML configuration (e.g a member of the ‘incus’ group) can create an environment variable containing newlines, which can be used to add additional configuration items in the container’s lxc.conf due to newline injection. This can allow adding arbitrary lifecycle hooks, ultimately resulting in arbitrary command execution on the host. Exploiting this is

PUBLISHED

Vendor: lxc
Product: incus
Provider severity: HIGH
Conflicts: 0

CVE-2026-23952

ImageMagick is free and open-source software used for editing and manipulating digital images. Versions 14.10.1 and below have a NULL pointer dereference vulnerability in the MSL (Magick Scripting Language) parser when processing <comment> tags before images are loaded. This can lead to DoS attack due to assertion failure (debug builds) or NULL pointer dereference (release builds). This issue is fixed in version 14.10.2.

PUBLISHED

Vendor: ImageMagick
Product: ImageMagick
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-23951

SumatraPDF is a multi-format reader for Windows. All versions contain an off-by-one error in the validation code that only triggers with exactly 2 records, causing an integer underflow in the size calculation. This bug exists in PalmDbReader::GetRecord when opening a crafted Mobi file, resulting in an out-of-bounds heap read that crashes the app. There are no published fixes at the time of publication.

PUBLISHED

Vendor: sumatrapdfreader
Product: sumatrapdf
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-23950

A flaw was found in node-tar, a library for Node.js. This race condition vulnerability occurs due to incomplete handling of Unicode path collisions within the `path-reservations` system on case-insensitive filesystems, such as macOS APFS. A remote attacker can exploit this by providing a specially crafted tar archive containing filenames that cause these collisions, bypassing internal concurrency safeguards. Successful exploitation can lead to arbitrary file overwrite.

PUBLISHED

Vendor: Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, isaacs, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat, Red Hat
Product: Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9, Red Hat OpenShift AI (RHOAI), Red Hat JBoss Enterprise Application Platform 7, Red Hat Ansible Automation Platform 2, Red Hat Enterprise Linux 8, Red Hat Developer Hub, Red Hat OpenShift AI (RHOAI), Red Hat OpenShift Dev Spaces 3.27, OpenShift Lightspeed, Red Hat Enterprise Linux 9, Red Hat Trusted Artifact Signer 1.3, Red Hat 3scale API Management Platform 2, Red Hat Openshift Data Foundation 4, Migration Toolkit for Containers, Red Hat Enterprise Linux 8, Red Hat Fuse 7, Red Hat Enterprise Linux 10, Multicluster Engine for Kubernetes, Red Hat 3scale API Management Platform 2, Red Hat OpenShift Container Platform 4, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7, Red Hat build of Apache Camel - HawtIO 4, Red Hat OpenShift GitOps, Red Hat 3scale API Management Platform 2, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, Red Hat Advanced Cluster Management for Kubernetes 2, Red Hat OpenShift Container Platform 4, Red Hat Openshift Data Foundation 4, Red Hat 3scale API Management Platform 2, Red Hat Connectivity Link 1, Logging Subsystem for Red Hat OpenShift, Red Hat JBoss Enterprise Application Platform Expansion Pack, Red Hat Enterprise Linux AI (RHEL AI) 3, Confidential Compute Attestation, Red Hat Enterprise Linux 9, OpenShift Serverless, Red Hat Single Sign-On 7, Red Hat 3scale API Management Platform 2, Red Hat 3scale API Management Platform 2, Network Observability Operator, Red Hat Enterprise Linux 6, Red Hat Satellite 6, Cryostat 4, OpenShift Pipelines, Node HealthCheck Operator, Red Hat Enterprise Linux 9, Red Hat Quay 3, Red Hat Trusted Artifact Signer 1.2, Multicluster Engine for Kubernetes, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 8, Red Hat JBoss Enterprise Application Platform 8, node-tar, Red Hat Process Automation 7, Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 8, Red Hat 3scale API Management Platform 2, Red Hat 3scale API Management Platform 2, Red Hat 3scale API Management Platform 2, Red Hat AMQ Broker 7, Red Hat Enterprise Linux 10
Provider severity: HIGH
Conflicts: 2

CVE-2026-2395

Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Xpoda Türkiye Informatics Technology Inc. No Code Platform allows SQL Injection. This issue affects No Code Platform: from 4.1.3 before 4.1.4.

PUBLISHED

Vendor: Xpoda Türkiye Informatics Technology Inc.
Product: No Code Platform
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-23949

jaraco.context, an open-source software package that provides some useful decorators and context managers, has a Zip Slip path traversal vulnerability in the `jaraco.context.tarball()` function starting in version 5.2.0 and prior to version 6.1.0. The vulnerability may allow attackers to extract files outside the intended extraction directory when malicious tar archives are processed. The strip_first_component filter splits the path on the first `/` and extracts the second component, while allow

PUBLISHED

Vendor: jaraco
Product: jaraco.context
Provider severity: HIGH
Conflicts: 0

CVE-2026-23948

FreeRDP is a free implementation of the Remote Desktop Protocol. Prior to 3.22.0, a NULL pointer dereference vulnerability in rdp_write_logon_info_v2() allows a malicious RDP server to crash FreeRDP proxy by sending a specially crafted LogonInfoV2 PDU with cbDomain=0 or cbUserName=0. This vulnerability is fixed in 3.22.0.

PUBLISHED

Vendor: FreeRDP
Product: FreeRDP
Provider severity: MEDIUM
Conflicts: 0

CVE-2026-23947

Orval generates type-safe JS clients (TypeScript) from any valid OpenAPI v3 or Swagger v2 specification. Versions prior to 7.19.0 until 8.0.2 are vulnerable to arbitrary code execution in environments consuming generated clients. This issue is similar in nature to CVE-2026-22785, but affects a different code path in @orval/core that was not addressed by CVE-2026-22785's fix. The vulnerability allows untrusted OpenAPI specifications to inject arbitrary TypeScript/JavaScript code into generated cl

PUBLISHED

Vendor: orval-labs
Product: orval
Provider severity: CRITICAL
Conflicts: 0

CVE-2026-23946

Tendenci is an open source content management system built for non-profits, associations and cause-based sites. Versions 15.3.11 and below include a critical deserialization vulnerability in the Helpdesk module (which is not enabled by default). This vulnerability allows Remote Code Execution (RCE) by an authenticated user with staff security level due to using Python's pickle module in helpdesk /reports/. The original CVE-2020-14942 was incompletely patched. While ticket_list() was fixed to use

PUBLISHED

Vendor: tendenci
Product: tendenci
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-23944

Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to version 1.13.2, unauthenticated requests could be proxied to remote environment agents, allowing access to remote environment resources without authentication. The environment proxy middleware handled `/api/environments/{id}/...` requests for remote environments before authentication was enforced. When the environment ID was not local, the middleware proxied the request and attached the manager-held ag

PUBLISHED

Vendor: getarcaneapp
Product: arcane
Provider severity: HIGH
Conflicts: 0

CVE-2026-23943

Improper Handling of Highly Compressed Data (Compression Bomb) vulnerability in Erlang OTP ssh (ssh_transport modules) allows Denial of Service via Resource Depletion. The SSH transport layer advertises legacy zlib compression by default and inflates attacker-controlled payloads pre-authentication without any size limit, enabling reliable memory exhaustion DoS. Two compression algorithms are affected: * zlib: Activates immediately after key exchange, enabling unauthenticated attacks * zlib@op

PUBLISHED

Vendor: Erlang, Erlang
Product: OTP, OTP
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-23942

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Erlang OTP (ssh_sftpd module) allows Path Traversal. This vulnerability is associated with program files lib/ssh/src/ssh_sftpd.erl and program routines ssh_sftpd:is_within_root/2. The SFTP server uses string prefix matching via lists:prefix/2 rather than proper path component validation when checking if a path is within the configured root directory. This allows authenticated users to access sibling

PUBLISHED

Vendor: Erlang, Erlang
Product: OTP, OTP
Provider severity: MEDIUM
Conflicts: 1

CVE-2026-23941

Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') vulnerability in Erlang OTP (inets httpd module) allows HTTP Request Smuggling. This vulnerability is associated with program files lib/inets/src/http_server/httpd_request.erl and program routines httpd_request:parse_headers/7. The server does not reject or normalize duplicate Content-Length headers. The earliest Content-Length in the request is used for body parsing while common reverse proxies (nginx, Apache httpd, Envoy

PUBLISHED

Vendor: Erlang, Erlang
Product: OTP, OTP
Provider severity: HIGH
Conflicts: 1

CVE-2026-23940

Uncontrolled Resource Consumption vulnerability in hexpm hexpm/hexpm allows Excessive Allocation. Publishing an oversized package can cause Hex.pm to run out of memory while extracting the uploaded package tarball. This can terminate the affected application instance and result in a denial of service for package publishing and potentially other package-processing functionality. This issue affects hexpm: before 495f01607d3eae4aed7ad09b2f54f31ec7a7df01; hex.pm: before 2026-03-10.

PUBLISHED

Vendor: hexpm, hexpm
Product: hexpm, hex.pm
Provider severity: HIGH
Conflicts: 1

CVE-2026-2394

Buffer Over-read vulnerability in RTI Connext Professional (Core Libraries) allows Overread Buffers.This issue affects Connext Professional: from 7.4.0 before 7.7.0, from 7.0.0 before 7.3.1.1, from 6.1.0 before 6.1.2.34, from 6.0.0 before 6.0.*, from 5.3.0 before 5.3.*, from 4.3x before 5.2.*.

PUBLISHED

Vendor: RTI
Product: Connext Professional
Provider severity: MEDIUM
Conflicts: 1