Latest CVEs

CVE-2026-53487 - Kite has an authenticated cluster RBAC bypass in /api/v1/overview
Published: August 21, 2026
CVE ID :CVE-2026-53487
Published : Aug. 21, 2026, 9:35 p.m. | 22 minutes ago
Description :Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request `/api/v1/overview` for a cluster that their roles do not permit by selecting that cluster with `x-cluster-name`. The overview route is registered before `middleware.RBACMiddleware()` and `GetOverview` only checks `len(user.Roles) > 0`, so it returns aggregate Kubernetes inventory and capacity data from unauthorized clusters. Version 0.12.3 fixes the issue.
Severity: 0.0 | NA

CVE-2026-53531 - ratex-parser has unbounded parser recursion that leads to stack overflow (process abort)
Published: August 21, 2026
CVE ID :CVE-2026-53531
Published : Aug. 21, 2026, 9:34 p.m. | 23 minutes ago
Description :RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, RaTeX’s recursive-descent parser recurses one (or more) native stack frame per nesting level at `{`, `\left`, `\sqrt{`, `^{`, etc, with no maximum depth limit. A short, ~10 KB input of nested groups overflows the 8 MB main-thread stack and aborts the process. With `panic = "abort"` (`Cargo.toml:48`), and because a Rust stack overflow is always a fatal `SIGABRT` regardless of panic strategy this is an unrecoverable, whole-process denial of service reachable from a single untrusted LaTeX string. Version 0.1.11 fixes the issue.
Severity: 0.0 | NA

CVE-2026-53530 - ratex-parser panics on `\verb` with a multibyte delimiter (UTF-8 byte-boundary slice)
Published: August 21, 2026
CVE ID :CVE-2026-53530
Published : Aug. 21, 2026, 9:31 p.m. | 26 minutes ago
Description :RaTeX is a KaTeX-compatible math rendering engine written in Rust. Prior to version 0.1.11, the public parser entrypoint `ratex_parser::parse(&str)` panics on the 9-byte input `\verbéxé` (i.e. `\verb` followed by the non-ASCII delimiter `é`). When handling a `\verb` command, the parser slices the verbatim argument with byte indices (`arg[1..arg.len() - 1]`); if the delimiter character is multibyte UTF-8, index `1` lands inside that character and Rust panics with *“byte index 1 is not a char boundary”*. Because RaTeX’s release profile sets `panic = "abort"` (`Cargo.toml:48`), the panic aborts the entire process — not just the current request/thread — making this a hard denial of service for any service that renders untrusted LaTeX. Version 0.1.11 fixes the issue.
Severity: 0.0 | NA

CVE-2026-53529 - LeafWiki vulnerable to stored XSS via search-result title (highlight() returns raw title into dangerouslySetInnerHTML)
Published: August 21, 2026
CVE ID :CVE-2026-53529
Published : Aug. 21, 2026, 9:29 p.m. | 28 minutes ago
Description :LeafWiki is a self-hosted wiki. Prior to version 0.10.2, page titles returned by the search API could be rendered as raw HTML in the frontend. A user with editor or administrator permissions could create or modify a page title containing an HTML/JavaScript payload. When another user searched for a matching term, the payload could execute in the victim’s browser. The impact depends on deployment configuration. With `--public-access` enabled, unauthenticated visitors could be affected. In authenticated-only deployments, the issue could be used for cross-user XSS against logged-in users who can access search results. The issue has been fixed in version 0.10.2 by ensuring that author-controlled page titles in search results are not interpreted as raw HTML by the browser while preserving search result highlighting.
Severity: 0.0 | NA

CVE-2026-53528 - FileWiki has path traversal in RenameAsset via unsanitized oldFilename parameter
Published: August 21, 2026
CVE ID :CVE-2026-53528
Published : Aug. 21, 2026, 9:26 p.m. | 30 minutes ago
Description :LeafWiki is a self-hosted wiki. Versions 0.3.0 through 0.10.0 have a path traversal vulnerability in LeafWiki’s asset rename functionality. An authenticated user with editor permissions could move files that are accessible to the LeafWiki server process into a page’s asset directory. This could allow sensitive local files, such as the application database, to become downloadable as page assets. Users should update to version 0.10.1 or greater. As an additional mitigation, operators should ensure that the LeafWiki process runs with the least privileges necessary and does not have filesystem access to sensitive files outside the application’s required directories. Until a patch is applied, operators may reduce risk by restricting editor access to trusted users only and by limiting the filesystem permissions of the LeafWiki process.
Severity: 0.0 | NA

CVE-2026-53527 - LeafWiki Vulnerable to Privilege Escalation via User Self-Service Update
Published: August 21, 2026
CVE ID :CVE-2026-53527
Published : Aug. 21, 2026, 9:25 p.m. | 32 minutes ago
Description :LeafWiki is a self-hosted wiki. Versions 0.1.0 through 0.10.0 have a privilege escalation vulnerability in the user update API. An authenticated user could update their own account role and escalate privileges from a regular user, such as `viewer`, to `admin`. Exploitation requires a valid authenticated LeafWiki user account. Instances without public registration and with only trusted users are at lower practical risk. Users should update to version 0.10.1 or greater. Until a patch is available, operators should restrict account creation and ensure that only trusted users have accounts on affected LeafWiki instances. If possible, access to the user update API should be restricted to trusted users or administrators only.
Severity: 0.0 | NA

CVE-2026-33240 - Combodo iTop: Reflected XSS in foreign key search criteria
Published: August 21, 2026
CVE ID :CVE-2026-33240
Published : Aug. 21, 2026, 9:25 p.m. | 32 minutes ago
Description :Combodo iTop is a web based IT service management tool. Prior to 3.2.3, there was a Reflected Cross-Site Scripting (XSS) vulnerability in the foreign key search criteria API. This issue has been fixed in version 3.2.3.
Severity: 0.0 | NA

CVE-2026-33047 - Combodo iTop: Object can be locked by a user without write permissions
Published: August 21, 2026
CVE ID :CVE-2026-33047
Published : Aug. 21, 2026, 9:21 p.m. | 36 minutes ago
Description :Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3.
Severity: 0.0 | NA

CVE-2026-53509 - @aborruso/ckan-mcp-server: SSRF via base_url allows access to internal networks (Potential fix bypass of CVE-2026-33060)
Published: August 21, 2026
CVE ID :CVE-2026-53509
Published : Aug. 21, 2026, 9:21 p.m. | 36 minutes ago
Description :CKAN MCP Server is a tool for querying CKAN open data portals. A known vulnerability CVE-2026-33060 indicated tools including ckan_package_search and sparql_query that accept a base_url parameter had the risk of making HTTP requests to arbitrary endpoints without restriction. A fix was applied to filter out ip addresses. However, a method to bypass exists prior to version 0.4.106. CKAN MCP Server validates caller-supplied CKAN server URLs by inspecting only the parsed hostname string before issuing outbound HTTP requests. In `src/utils/http.ts`, hostname aliases such as `ip6-localhost` are not equal to `localhost`, are not dotted IPv4 literals, and are not bracketed IPv6 literals, so they pass the SSRF filter but can resolve to loopback when the server performs the request. A remote MCP caller that can invoke CKAN tools with a `server_url` can therefore make the server connect to local or private addresses and, for CKAN-shaped responses, receive response-derived data. The updated fix in version 0.4.106 replaced the single `hostname === 'localhost'` check with a blocked-hostname `Set` covering `ip6-localhost` and `ip6-loopback`.
Severity: 0.0 | NA

CVE-2026-53497 - CrossWatch: Unauthenticated /api/app-auth/status endpoint leaks active session metadata (IP, User-Agent, session IDs)
Published: August 21, 2026
CVE ID :CVE-2026-53497
Published : Aug. 21, 2026, 9:19 p.m. | 38 minutes ago
Description :CrossWatch (CW) is a synchronization engine. Prior to version 0.9.21, GET /api/app-auth/status is accessible without authentication and returns the other_sessions array, which exposes metadata of all active sessions — including originating IP addresses, User-Agent strings, internal session IDs, and creation/expiry timestamps. Any unauthenticated network attacker can enumerate this data without credentials. Version 0.9.21 fixes the issue.
Severity: 0.0 | NA

CVE-2026-43980 - Malla: Stored XSS via Meshtastic node names in multiple frontend pages
Published: August 21, 2026
CVE ID :CVE-2026-43980
Published : Aug. 21, 2026, 9:17 p.m. | 40 minutes ago
Description :Malla is a web analyzer for Meshtastic networks based on MQTT data. Prior to commit 4086e2b5f61615a813b70b25bc76095083552135, code names (long_name, short_name) received via MQTT are stored in SQLite without sanitization and rendered into the DOM without escaping. Any participant on a public Meshtastic MQTT broker can set a malicious node name that executes JavaScript in the browser of every Malla dashboard visitor. Commit 4086e2b5f61615a813b70b25bc76095083552135 fixes the issue.
Severity: 0.0 | NA

CVE-2026-31936 - Combodo iTop: Unauthorized access to object information via search operation
Published: August 21, 2026
CVE ID :CVE-2026-31936
Published : Aug. 21, 2026, 9:17 p.m. | 40 minutes ago
Description :Combodo iTop is a web based IT service management tool. Prior to 3.2.3, users can access to unauthorized object information through the search operation. This issue has been fixed in version 3.2.3.
Severity: 0.0 | NA

CVE-2026-77811 - Stored Cross-Site Scripting via Integration Template Asset in OpenSearch Dashboards
Published: August 21, 2026
CVE ID :CVE-2026-77811
Published : Aug. 21, 2026, 9:17 p.m. | 40 minutes ago
Description :Improper input validation in the dashboards-observability plugin in OpenSearch Dashboards allows a remote authenticated user with write permissions to OpenSearch Dashboards saved objects to execute arbitrary JavaScript in the context of other users' browser sessions by uploading a saved asset with arbitrary web content.
Severity: 8.7 | HIGH

CVE-2026-77415 - JSONata: Arbitrary Code Execution via crafted JSONata expressions
Published: August 21, 2026
CVE ID :CVE-2026-77415
Published : Aug. 21, 2026, 9:17 p.m. | 40 minutes ago
Description :JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, crafted JSONata expressions could chain several object-integrity weaknesses to execute arbitrary code. The chain could overwrite $clone to mutate objects through evaluateTransformExpression, expose and deconstruct JSONata functions or lambdas through $merge.*, replace proc.arguments.forEach used by applyProcedure, and forge internal lambda state. These primitives allowed an attacker to reach prototype getters, prototype and constructor access, and process.getBuiltinModule with child_process, executing code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1.
Severity: 9.3 | CRITICAL

CVE-2026-77414 - JSONata: Arbitrary Code Execution via crafted JSONata expressions
Published: August 21, 2026
CVE ID :CVE-2026-77414
Published : Aug. 21, 2026, 9:17 p.m. | 40 minutes ago
Description :JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.1, the src/jsonata.js environment.lookup function used a bypassable hasOwnProperty check. Crafted expressions could use $hasOwnProperty, $spread, $string, prototype access, and $constructor to reach the object prototype and invoke process.getBuiltinModule with child_process, executing arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.1.
Severity: 9.3 | CRITICAL

CVE-2026-77413 - JSONata: Arbitrary Code Execution via crafted JSONata expressions
Published: August 21, 2026
CVE ID :CVE-2026-77413
Published : Aug. 21, 2026, 9:17 p.m. | 40 minutes ago
Description :JSONata is a JSON query and transformation language. Prior to 1.8.8 and 2.2.0, the src/functions.js lookup function lacked an Object.prototype.hasOwnProperty check and allowed crafted expressions to access inherited prototype members. An attacker able to supply an expression could use inherited prototype setters and getters, constructor access, valueOf, and process.getBuiltinModule to reach the child_process module and execute arbitrary code with the privileges of the host process. This issue is fixed in versions 1.8.8 and 2.2.0.
Severity: 9.3 | CRITICAL

CVE-2026-77354 - kin-openapi: Uncontrolled resource consumption in openapi3filter deepObject query parameter decoding
Published: August 21, 2026
CVE ID :CVE-2026-77354
Published : Aug. 21, 2026, 9:17 p.m. | 40 minutes ago
Description :kin-openapi is a Go project for handling OpenAPI files. From 0.124.0 until 0.142.0, openapi3filter.sliceMapToSlice in openapi3filter/req_resp_decoder.go converts attacker-controlled sparse indexes from a deepObject query parameter into a dense slice by allocating entries from zero through the largest supplied index, after which buildResObj creates another slice of the same length. This allocation occurs before schema validation, so maxItems does not prevent it. An unauthenticated client can send a small query such as param[items][50000000]=x to an endpoint whose deepObject schema contains an array, forcing multi-gigabyte heap allocation and causing an OOM kill or restart loop. Other request-body encodings and styled parameters that do not produce bracketed integer indexes are not affected. This issue is fixed in version 0.142.0.
Severity: 8.7 | HIGH

CVE-2026-77220 - PDFio < 1.6.5 Dangling Pointer via Dictionary String-Formatting
Published: August 21, 2026
CVE ID :CVE-2026-77220
Published : Aug. 21, 2026, 9:17 p.m. | 40 minutes ago
Description :PDFio before 1.6.5 contains a dangling pointer vulnerability in the dictionary string-formatting function that stores a pointer to a stack-local buffer in the document dictionary without copying the string value. In multi-threaded or pooled-request environments, attackers or concurrent users can trigger stack memory reuse across requests, causing cross-tenant document content corruption by silently overwriting one caller's dictionary string values with another caller's data.
Severity: 7.1 | HIGH

CVE-2026-77219 - GNU Emacs < 31.0.91 Heap Over-Read via PBM/PPM/PGM Image Loader
Published: August 21, 2026
CVE ID :CVE-2026-77219
Published : Aug. 21, 2026, 9:17 p.m. | 40 minutes ago
Description :GNU Emacs before 31.0.91 contains an integer overflow in the PBM/PPM/PGM image loader that allows an attacker to leak heap memory contents by supplying a crafted image with large dimensions and an elevated max color index. The image loader multiplies image dimensions and channel count using signed integer arithmetic; for sufficiently large values, the result wraps to a negative number, bypassing the bounds check and causing the pixel reader to access heap memory past the end of the allocated buffer. The over-read contents are interpreted as pixel color values and rendered on screen.
Severity: 7.1 | HIGH

CVE-2026-76905 - kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS
Published: August 21, 2026
CVE ID :CVE-2026-76905
Published : Aug. 21, 2026, 9:17 p.m. | 40 minutes ago
Description :kin-openapi is a Go project for handling OpenAPI files. From 0.10.0 until 0.141.0, openapi3filter.convertParseError in openapi3filter/validation_error_encoder.go dereferences e.Parameter.In without checking whether e.Parameter is nil. A malformed non-string scalar field in a multipart/form-data request body produces a nested ParseError with a nil RequestError.Parameter, and applications that render the validation error through openapi3filter.ConvertErrors or ValidationErrorEncoder panic. An unauthenticated client can repeatedly send such requests to deny service when the application lacks a recovery boundary. JSON request bodies and applications that do not use these error-rendering helpers are not affected. This issue is fixed in version 0.141.0.
Severity: 7.5 | HIGH

CVE-2026-76904 - GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers
Published: August 21, 2026
CVE ID :CVE-2026-76904
Published : Aug. 21, 2026, 9:17 p.m. | 40 minutes ago
Description :GeoTools is an open source Java library that provides tools for geospatial data. Starting in version 30.5 and prior to versions 33.6, 34.5, and 33.6, an SQL Injection Vulnerability is present when executing OGC Filters with PostGIS DataStore implementation: `jsonArrayContains` function; Requires PostGIS 12 or greater with a String or JSON field. For PostGIS 12 and greater `jsonArrayContains(, , )` function writes `` into generated SQL without escaping. Patches are available in versions 33.6, 34.5, and 33.6. No known workaround is available. To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.
Severity: 9.8 | CRITICAL

CVE-2026-69238 - HTML injection vulnerability in Esri Portal for ArcGIS
Published: August 21, 2026
CVE ID :CVE-2026-69238
Published : Aug. 21, 2026, 9:17 p.m. | 40 minutes ago
Description :There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.5 and prior that allows a remote, highly priviliged attacker to insert arbitrary HTML into the Portal for ArcGIS Home application. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.
Severity: 3.5 | LOW

CVE-2026-69237 - HTML injection vulnerability in Esri Portal for ArcGIS
Published: August 21, 2026
CVE ID :CVE-2026-69237
Published : Aug. 21, 2026, 9:17 p.m. | 40 minutes ago
Description :There is an HTML injection vulnerability in Esri Portal for ArcGIS versions 11.3 and prior that allows a remote attacker with administrative privileges to insert arbitrary HTML into an administrative API. Users working with ArcGIS Enterprise 11.1, and 11.3 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.
Severity: 3.8 | LOW

CVE-2026-69236 - stored cross site scripting issue in Esri Portal for ArcGIS
Published: August 21, 2026
CVE ID :CVE-2026-69236
Published : Aug. 21, 2026, 9:17 p.m. | 40 minutes ago
Description :There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 12.1 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary JavaScript in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, 11.5, 12.0 or 12.1 are encouraged to patch. All users are advised to upgrade to the latest long-term support release and apply the patch.
Severity: 6.1 | MEDIUM

CVE-2026-69235 - stored cross site scripting issue in Esri Portal for ArcGIS
Published: August 21, 2026
CVE ID :CVE-2026-69235
Published : Aug. 21, 2026, 9:17 p.m. | 40 minutes ago
Description :There is a stored cross site scripting issue in Esri Portal for ArcGIS versions 11.5 and prior that may allow a remote, privileged attacker to inject malicious code that could potentially execute arbitrary in a victim’s browser. Users working with ArcGIS Enterprise 11.1, 11.3, and 11.5 are encouraged to patch. All users are advised to upgrade to the latest long-term support release.
Severity: 6.1 | MEDIUM