| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Vault Community Edition and Vault Enterprise did not consistently apply explicit ACL policy deny rules to request paths that differ only by a trailing slash. This may allow an authenticated user who holds a broader delete permission on system configuration paths to disable a secrets engine, auth method, or audit device that a more specific deny rule was intended to protect. This vulnerability (CVE-2026-93335) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25. |
| Astro is a web framework for content-driven websites. From 0.2.0 until 7.1.2, the @astrojs/solid-js renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. A request-controlled slot name containing a quote could terminate the attribute and inject active HTML. Exploitation required a hydrated Solid component using a client:* directive and dynamic access to the attacker-chosen slot property; a component that did not render that slot emitted only escaped fallback content. This issue is fixed in version 7.1.2. |
| HashiCorp Vault and Vault Enterprise are vulnerable to an issue in the integrated storage join process that may allow an unauthenticated attacker with network access to a new, uninitialized node to cause that node to send credentials from its server environment to an attacker-controlled server. This vulnerability (CVE-2026-92735) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25. |
| In smmu_find_ste of smmu.c, there is a possible way to retain stale translation lookaside buffer entries across stream identifiers due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| In arm_lpae_split_blk_unmap of drivers/iommu/io-pgtable-arm-common.c, there is a possible Logic error due to a logic error in the code. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation. |
| In smmu_unmap_visit_leaf of arm-smmu-v3.c, there is a possible way to release active direct memory access page references during unmapping due to a logic error. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. |
| In multiple functions of face_status.h, there is a possible way to modify verified biometric enrollment data in shared memory due to a race condition. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. |
| In slice_header of hevc_decoder, there is a possible Non-Heap Buffer Overflow due to a buffer overflow. This could lead to local escalation of privilege with execution privileges needed. User interaction is for exploitation. |
| In acquireMemory of bt_bqr_offload.cc, there is a possible way to trigger an out of bounds write via a buffer size underflow due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. |
| A security vulnerability exists in AthonetOS that may allow an unauthorized party to affect service operation or gain access to certain protected system functions. Successful exploitation could result in a compromise of service integrity or unauthorized system access. |
| A vulnerability exists in a network-facing component that may, under certain conditions, result in service disruption. Successful exploitation could cause temporary unavailability of affected functionality. |
| A vulnerability exists in a system component that may, under certain conditions, disrupt the availability of affected services. Successful exploitation could result in temporary service interruption or loss of functionality. |
| SQL injection in the LLM usage counters of Kong Gateway Enterprise and Kong AI Gateway may allow a client to execute arbitrary SQL against the Kong database via a crafted model name. |
| In affected versions of Octopus Server, incorrect validation of the permissions assigned to a user that would allow them to create project triggers could result in the user being able to run runbooks or create deployments they were not authorised to perform. |
| A flaw was found in OpenSCAP. When decomposing a Source DataStream (SDS) file, the application does not properly validate relative file path attributes, leading to a path traversal vulnerability. An attacker can exploit this flaw by tricking a user or automated system into decomposing a crafted datastream containing directory traversal sequences. Successful exploitation allows unauthorized file creation or modification outside the intended target directory with the permissions of the executing process. |
| The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content[title]' parameter in all versions up to, and including, 7.8.14.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with custom-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires that an administrator has explicitly granted the 'Create and Update Modules' (hustle_create / hustle_edit_module) capability to the attacker's role via the plugin's own Settings → Permissions feature; this delegation is not enabled by default. |
| PowerDNS-Admin through 2026.08.1 contains an authorization bypass vulnerability that allows authenticated User-role accounts to refresh secondary zones they cannot access by supplying a different 'domain' field in the JSON body. Attackers authorized for any one zone can force axfr-retrieve transfers of other users' secondary zones and infer zone existence from differing responses. |
| Astro is a web framework for content-driven websites. From 5.7.3 until 9.1.2, the @astrojs/svelte renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. Request-controlled slot names containing a quote could terminate the attribute and inject active HTML. Exploitation required a hydrated Svelte component using a client:* directive and dynamic rendering of the attacker-chosen slot; components that did not render that slot emitted only Astro's escaped fallback content. Both server rendering and client-side hydration used the unsafe slot name. This issue is fixed in version 9.1.2. |
| Astro is a web framework for content-driven websites. Prior to 7.4.5, Astro rendered a string used as a dynamic element name as raw HTML after applying an incomplete character filter. A / in the string could make an HTML parser treat the remainder as attributes, allowing untrusted element-name input to inject event-handler markup. The .astro dynamic-tag renderer, JSX renderer, and MDX renderer were affected, and exploitation required an application to use request-controlled or stored untrusted data as all or part of an element name. This issue is fixed in version 7.4.5. |
| OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.2, TraceContextTextMapPropagator.extract() in opentelemetry-api can perform quadratic-time regular-expression backtracking on a malformed traceparent value containing a trace-context prefix, a long whitespace sequence, and an embedded newline. Exploitation requires an attacker-controlled carrier that preserves embedded newlines and permits a sufficiently large value, because conforming HTTP header values cannot contain embedded newlines. JSON-based carriers, including applicable MCP request metadata integrations, can preserve the required newline depending on the SDK, instrumentation, and message-size limits. Parsing on an asynchronous server's event-loop thread can consume excessive CPU and delay unrelated requests, while the advisory does not establish disclosure, modification, or code execution. This issue is fixed in version 1.45.2. |
