CVE Notifier

CVE-2026-81446 CWE-918 7.4

CVE-2026-81446

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Server-Side Request Forgery (SSRF) vulnerability. An unauthenticated attacker with remote access could potentially exploit this vulnerability, …

cve.org Dell:OpenManage · Server · Administrator 5 hari lalu

CVE-2026-85078 CWE-444 6.5

sanic chunked trailer request smuggling allows hidden second request execution

Sanic is an opensource python web server/framework. In version 25.12.0, Sanic's core HTTP/1.1 chunked-body handling does not fully consume the trailer-part after the terminating zero chunk before reusing the keep-alive c…

cve.org sanic-org:sanic 5 hari lalu

CVE-2026-81445 CWE-269 7.2

CVE-2026-81445

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Privilege Management vulnerability. A high privileged attacker with remote access could potentially exploit this vulnerability, leadi…

cve.org Dell:OpenManage · Server · Administrator 5 hari lalu

CVE-2026-85077 CWE-113 8.2

Sanic: HTTP response header injection via missing CR/LF validation in Sanic HTTP/1.1 responses

Sanic is an opensource python web server/framework. Prior to version 24.12.1, and in version 25.12.0, the HTTP/1.1 response pipeline in sanic/response/types.py serializes response header names and values without rejectin…

cve.org sanic-org:sanic 5 hari lalu

CVE-2026-77614 CWE-384 8.8

Opencast: Session fixation in login enables account takeover via crafted link

Opencast is a free, open-source platform to support the management of educational audio and video content. Prior to versions 19.7 and 20.2, the default security configuration in etc/security/mh_default_org.xml accepts a …

cve.org opencast:opencast 5 hari lalu

CVE-2026-92987 CWE-407 7.5

roxmltree through 0.21.1 Denial of Service via Quadratic Parsing

roxmltree through 0.21.1 performs quadratic-time attribute and namespace validation during XML parsing without limits on attribute count. Attackers can craft XML documents with tens of thousands of attributes on a single…

cve.org RazrFalcon:roxmltree 5 hari lalu

CVE-2026-92986 CWE-79 8.8

SiYuan before 3.8.4 Cross-Site Scripting via Document Title

SiYuan before 3.8.4 renders document titles as HTML in the backlink dock tree without escaping markup characters. Attackers can set malicious titles through the rename API or crafted notebooks to execute scripts in the E…

cve.org siyuan-note:siyuan 5 hari lalu

CVE-2026-92985 CWE-79 8.8

SiYuan before 3.8.4 Cross-Site Scripting via Bookmark Labels

SiYuan versions before 3.8.4 fail to escape bookmark labels imported from notebook files when rendering them in the dock tree. Attackers can craft malicious .sy notebook files with unescaped HTML in bookmark attributes t…

cve.org siyuan-note:siyuan 5 hari lalu

CVE-2026-92984 CWE-384 8.1

HUBzero CMS through 2.2.32 Session Fixation via Query-String Session Identifier

HUBzero CMS through 2.2.32 accepts session identifiers from query strings and request variables instead of cookies alone, allowing unauthenticated attackers to fixate victim sessions. Attackers can obtain a valid session…

cve.org hubzero:hubzero-cms 5 hari lalu

CVE-2026-92983 CWE-772 7.5

InternLM LMDeploy through 0.17.0 Memory Exhaustion via Session ID Mismatch

InternLM LMDeploy through 0.17.0 in DistServe prefill/decode disaggregation mode fails to release scheduler sessions because the proxy uses user-facing session IDs instead of internal scheduler keys. Unauthenticated atta…

cve.org InternLM:lmdeploy 5 hari lalu

CVE-2026-88952 CWE-287 N/A

OAuth2 sign-in attached to an existing account without an email comparison in AshAuthentication

Improper Authentication vulnerability in team-alembic AshAuthentication allows an attacker to be signed in as another user by linking an OAuth2 identity to an account that is not theirs. AshAuthentication.Strategy.OAuth…

cve.org team-alembic:ash_authentication · team-alembic:ash_authentication 5 hari lalu

CVE-2026-81453 CWE-22 6.5

CVE-2026-81453

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains an Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability. A low privileged attacker with remote access cou…

cve.org Dell:OpenManage · Server · Administrator 5 hari lalu