CVE Notifier

CVE-2026-86040 CWE-400 7.5

libp2p: Unbounded RPC decode + synchronous subscription processing in @libp2p/floodsub allows unauthenticated DoS

libp2p is a JavaScript implementation of the libp2p networking stack. Prior to 11.0.26, @libp2p/floodsub accepts unauthenticated RPC frames on /floodsub/1.0.0 through PeerStreams.attachInboundStream in packages/floodsub/…

cve.org libp2p:js-libp2p · @libp2p:floodsub 5 hari lalu

CVE-2026-91039 CWE-290 N/A

dynamic_oidc identities are not namespaced by connection in ash_authentication, allowing cross-connection account takeover

Authentication Bypass by Spoofing vulnerability in team-alembic ash_authentication allows an attacker who operates one identity-provider connection of a dynamic_oidc strategy to be signed in as a local user established t…

cve.org team-alembic:ash_authentication · team-alembic:ash_authentication 5 hari lalu

CVE-2026-86039 CWE-290 8.2

libp2p: PeerStore accepts attacker-signed PeerRecords for a victim peer ID and stores certified attacker addresses

libp2p is a JavaScript implementation of the libp2p networking stack. From 8.0.0 until 12.0.24, @libp2p/peer-store in packages/peer-store/src/index.ts uses consumePeerRecord to verify a RecordEnvelope signature but does …

cve.org libp2p:js-libp2p 5 hari lalu

CVE-2026-86038 CWE-345 7.5

libp2p: Gossipsub StrictSign accepts attacker-signed messages as a victim RSA peer ID

libp2p is a JavaScript implementation of the libp2p networking stack. From 15.0.0 until 16.0.5, @libp2p/gossipsub uses the default StrictSign policy in packages/gossipsub/src/utils/buildRawMessage.ts, where validateToRaw…

cve.org libp2p:js-libp2p 5 hari lalu

CVE-2026-93015 CWE-787 6.3

BlueKitchen BTstack through 1.8.2 A2DP SEP Discovery Out-of-Bounds Write

BlueKitchen BTstack through 1.8.2 fails to validate the peer-reported endpoint count against table bounds in A2DP stream endpoint discovery. A bonded peer can send an AVDTP DISCOVER response with more endpoints than the …

cve.org BlueKitchen · GmbH:BTstack 5 hari lalu

CVE-2026-93014 CWE-22 7.1

RosarioSIS before 12.9 Path Traversal in File Deletion via filename Parameter

RosarioSIS versions before 12.9 fail to validate the filename request parameter in Users and Students modules, allowing authenticated users to unlink allow-listed files via path traversal. Attackers can use parent-direct…

cve.org RosarioSIS:RosarioSIS 5 hari lalu

CVE-2026-93013 CWE-22 4.3

RAGFlow through 0.27.2 Tenant Import Endpoints Path Traversal

RAGFlow through 0.27.2 contains a path traversal vulnerability in the dev_insert_chunks_from_file and dev_insert_metadata_from_file endpoints that allows authenticated attackers to read arbitrary files by supplying absol…

cve.org infiniflow:ragflow 5 hari lalu

CVE-2026-76834 CWE-502 8.1

b2evolution CMS 6.7.8 through 7.2.5 Object Injection via Negative Integer Array Key

b2evolution CMS versions 6.7.8 through 7.2.5 contain an incomplete fix for CVE-2016-8901 where the serialized-array object check in param_check_serialized_array() fails to reject payloads with negative integer array keys…

cve.org b2evolution:b2evolution · CMS 5 hari lalu

CVE-2026-12284 CWE-346 3.8

Mattermost Desktop App Missing IPC Sender Validation in Calls Leave Handler

Mattermost Desktop App versions <=6.2 6.2.2.0 fails to validate the IPC sender in the leaveCall handler which allows a malicious or compromised Mattermost server (or a user with script access to a connected server view) …

cve.org Mattermost:Mattermost 5 hari lalu

CVE-2026-76781 CWE-476 5.5

Libxml2: libxml2: null pointer dereference parsing nextcatalog without catalog attribute

A flaw was found in libxml2. A local user or an attacker providing a specially crafted XML catalog can trigger a NULL pointer dereference during XML catalog parsing. This occurs when a `nextCatalog` element lacks its man…

cve.org Red · Hat:Red · Hat 5 hari lalu

CVE-2026-75588 CWE-1287 2.6

Mattermost Desktop App plugin popout scheme validation bypass

Mattermost Desktop App versions <=6.2 6.2.2.0 fail to validate the URL scheme when checking whether a target URL is internal to the connected server, which allows a network-positioned attacker to load a plugin popout win…

cve.org Mattermost:Mattermost 5 hari lalu

CVE-2026-92880 CWE-787 6.3

vgmstream EA SCHl parser vadpcm_decoder.c vadpcm_read_coefs_be out-of-bounds write

A weakness has been identified in vgmstream up to r2117. Impacted is the function vadpcm_read_coefs_be of the file src/coding/vadpcm_decoder.c of the component EA SCHl parser. This manipulation of the argument entry/entr…

cve.org n/a:vgmstream 5 hari lalu