CVE Notifier

CVE-2026-86358 CWE-121 6.5

CVE-2026-86358

Dell Update Package Framework, versions prior to 26.07.03, contains a Stack-based Buffer Overflow vulnerability. An unauthenticated attacker with adjacent network access could potentially exploit this vulnerability, lead…

cve.org Dell:Update · Package · Framework 16 Sep 2026

CVE-2026-85732 CWE-918 4.7

oras-go: Blind SSRF via unvalidated Link header URL in pagination allows internal network probing

oras-go is a Go library for managing OCI artifacts. Prior to 2.6.2, the parseLink function in registry/remote/utils.go accepts an absolute URL from a registry-controlled Link response header without validating its scheme…

cve.org oras-project:oras-go 16 Sep 2026

CVE-2026-71182 CWE-59 3.0

CVE-2026-71182

Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A high privileged attacker with local access could potentially exploit …

cve.org Dell:Update · Package · Framework 16 Sep 2026

CVE-2026-68904 CWE-400 7.0

node-opcua: TCP Socket Leak (FIN-WAIT-2) via keepalive reconnection cycle - Resource Exhaustion

node-opcua is an OPC UA implementation for TypeScript and Node.js. From 2.0.0 until 2.170.0, node-opcua clients using the default keepSessionAlive setting can enter a repeated reconnection cycle when an OPC UA server's c…

cve.org node-opcua:node-opcua 16 Sep 2026

CVE-2026-71181 CWE-59 3.0

CVE-2026-71181

Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Link Resolution Before File Access ('Link Following') vulnerability. A high privileged attacker with local access could potentially exploit …

cve.org Dell:Update · Package · Framework 16 Sep 2026

CVE-2026-69200 CWE-1321 3.7

node-opcua: Prototype Pollution via internal `fieldsToJson()` implementation (Related to CVE-2024-57086)

node-opcua is an OPC UA implementation for TypeScript and Node.js. Prior to node-opcua-client 2.145.0, the internal fieldsToJson method in packages/node-opcua-client/source/alarms_and_conditions/client_alarm.ts directly …

cve.org node-opcua:node-opcua 16 Sep 2026

CVE-2026-92399 CWE-122 7.3

GPAC WebSocket rmt_ws.c rmt_client_handle_ws_frame heap-based overflow

A vulnerability was determined in GPAC 26.07.0. This affects the function rmt_client_handle_ws_frame of the file src/utils/rmt_ws.c of the component WebSocket Handler. Executing a manipulation of the argument payload_siz…

cve.org n/a:GPAC 16 Sep 2026

CVE-2026-71180 CWE-252 8.2

CVE-2026-71180

Dell Update Package Framework, versions prior to 26.07.03, contains an Unchecked Return Value vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation …

cve.org Dell:Update · Package · Framework 16 Sep 2026

CVE-2026-59974 CWE-22 7.8

Stanza: Zip Slip Path Traversal in Model/Resource Extraction

Stanza is a Stanford NLP Python library for tokenization, sentence segmentation, NER, and parsing of many human languages. Prior to 1.14.0, stanza.resources.common.unzip in stanza/resources/common.py passes downloaded mo…

cve.org stanfordnlp:stanza 16 Sep 2026

CVE-2026-59944 CWE-22 6.1

Composer: CVE-2026-59946 fix bypass via symlinked package bin path

Composer is a dependency Manager for the PHP language. From 1.0 until 2.2.30 and from 2.3.0 until 2.10.3, a malicious or compromised dependency can bypass the earlier CVE-2026-59946 binary-path hardening because Composer…

cve.org composer:composer 16 Sep 2026

CVE-2026-71179 CWE-78 7.3

CVE-2026-71179

Dell Update Package Framework, versions prior to 26.07.03, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with local access…

cve.org Dell:Update · Package · Framework 16 Sep 2026

CVE-2026-92603 CWE-639 6.5

ContiNew Admin through 4.1.0 Unauthorized Message Deletion via UserMessageController

ContiNew Admin through 4.1.0 contains an authorization bypass vulnerability in the personal message delete endpoint that allows authenticated users to delete other users' messages and announcements. Attackers can supply …

cve.org continew-org:continew-admin 16 Sep 2026