Reserved but Public CVEs

CVE-2026-35511 is an account takeover vulnerability in Authorizer affecting OAuth identity linking logic. The flaw occurs when an OAuth identity is linked to an existing local account solely on the basis of a matching email address, without verifying that the pre-existing account's email address had already been validated by its legitimate owner. In the vulnerable workflow, an attacker can first create a local account using a victim's email address while leaving that account unverified. When the victim later authenticates through a legitimate OAuth provider using the same email address, the application links the OAuth identity to the attacker-created account. Because the attacker already controls the password-based credentials associated with that account, the attacker can retain access to the now-linked victim account. The issue is a logic flaw in account linking and identity proofing rather than memory corruption or injection.

CVE-2026-35511First seen Aug 15, 2026

CVE-2026-55157 is an OS command injection vulnerability in @ooples/token-optimizer-mcp affecting the smart_user tool's get-user-info operation. The flaw arises when an attacker-controlled username is passed to an execAsync shell command without sufficient neutralization of shell metacharacters or other unsafe input handling. This allows crafted input to alter the intended command and inject arbitrary operating system commands for execution on the host running the MCP server.

CVE-2026-55157First seen Aug 15, 2026

CVE-2026-53658 is an LDAP injection vulnerability in Hyperledger Fabric CA when it is configured to use an LDAP backend for authentication. The flaw is caused by unescaped username input being incorporated into the LDAP uid search filter during enrollment processing. Because the LDAP query is influenced before password validation occurs, a remote unauthenticated attacker can manipulate the directory search logic and alter how authentication attempts are resolved against LDAP entries.

CVE-2026-53658First seen Aug 15, 2026

CVE-2026-55156 is an unauthenticated path traversal vulnerability in the Token Optimizer MCP dashboard session log API endpoints in @ooples/token-optimizer-mcp. The flaw allows attacker-controlled sessionId input to influence filesystem path construction without sufficient validation or normalization, enabling traversal outside the intended hooks data directory. As a result, a remote attacker can cause the application to read .jsonl files from unintended locations that are accessible to the dashboard server process.

CVE-2026-55156First seen Aug 15, 2026

CVE-2026-53660 is an insecure default configuration issue in OpenAM Community Edition in which the iPlanetDirectoryPro single sign-on cookie is initialized with HttpOnly disabled and is also reused as a CSRF token in OAuth and OpenID Connect flows. This design weakens browser-enforced protections around the session token and couples session state with request forgery protection. In environments where attacker-controlled script can execute in the OpenAM origin, the cookie can be accessed directly and leveraged to compromise the authenticated user session and abuse authorization flows. The absence of a protective SameSite default further increases exposure to cross-site request forgery scenarios.

CVE-2026-53660First seen Aug 15, 2026

CVE-2026-53708 is a time-of-check time-of-use race condition in ContextForge Gateway affecting the /admin/gateways/test endpoint. The flaw arises from DNS being validated at one point and the hostname being resolved again when the outbound connection is made, allowing an attacker to exploit DNS rebinding and cause the application to connect to a different IP address than the one originally validated. This breaks the intended SSRF protections on the endpoint and can permit requests to internal or otherwise restricted destinations. In affected deployments, the issue can expose internal services and APIs and may allow access to cloud instance metadata services when reachable.

CVE-2026-53708First seen Aug 15, 2026

CVE-2026-55102 is an information exposure vulnerability in hashi-vault-js in which raw AxiosError objects are re-thrown without adequate sanitization. Because the exception object can retain HTTP request metadata, including authorization headers and request body content, sensitive Vault-related material such as tokens, passwords, and secret values may be exposed when applications capture and log these errors. The issue stems from improper handling of error objects returned during failed requests to Vault, allowing confidential data to propagate into downstream logging and observability systems.

CVE-2026-55102First seen Aug 14, 2026

CVE-2026-55072 is a SQL injection vulnerability in Pimcore affecting ClassDefinition and Block handling. The flaw is caused by insufficient validation of class definition UID values due to missing end anchors in the relevant validation regular expressions, combined with unsafe SQL query construction in Block handling where a class identifier is concatenated without proper identifier quoting. An authenticated user with permission to manage objects can create a malicious class definition and cause attacker-controlled SQL to be incorporated into a query when a data object of that class is loaded. This can result in arbitrary SQL execution against the underlying database.

CVE-2026-55072First seen Aug 14, 2026

CVE-2026-50204 is an information exposure vulnerability in Apache Airflow in which sensitive values submitted through bulk API endpoints were written to audit logs without masking. Specifically, Variable values and Connection extra contents could be logged in cleartext during bulk operations. As a result, authenticated users who can read audit logs may recover secrets even when they do not have direct permission to read the underlying Variables or Connections. The issue is caused by improper handling of sensitive data in logging paths for bulk endpoint submissions.

CVE-2026-50204First seen Aug 13, 2026

CVE-2026-73494 is a request smuggling vulnerability affecting Blaze/http4s Blaze components. Multiple HTTP/1.1 request-smuggling primitives exist in Blaze's Java wire parser and are reachable in the default BlazeServerBuilder configuration. The flaw arises from request-boundary parsing behavior that can disagree with stricter intermediaries or front-end components, causing the backend and proxy to interpret the same byte stream as different HTTP requests. This parser inconsistency can allow an attacker to smuggle a secondary request through a front-end device that applies different message-boundary handling.

CVE-2026-73494First seen Aug 13, 2026

CVE-2026-35445 is an authorization bypass vulnerability in the Winter CMS backend module affecting the Users controller. An authenticated backend user can supply a crafted `_handler` value in a POST request to bypass intended permission checks and trigger unauthorized controller methods. The issue stems from insufficient validation of postback handler names before they are passed to the AJAX handler dispatch mechanism, allowing invocation of methods that should not be reachable by the requesting user. As described, this can expose protected, private, or action-prefixed controller methods, including sensitive user-management functionality such as delete, restore, unsuspend, and manual password reset. The flaw is compounded by logic in the Users controller related to the `myaccount` action that weakens required permission enforcement.

CVE-2026-35445First seen Aug 13, 2026

CVE-2026-55071 is a command injection vulnerability in the stata-mcp ado_package_install tool. The flaw allows newline injection through the package parameter, which can be interpreted in a way that results in execution of arbitrary operating system commands via Stata shell command functionality. The vulnerable condition affects the ado package installation path exposed by the tool and equivalent Python API, where insufficient neutralization of special elements in externally supplied input permits attacker-controlled command execution.

CVE-2026-55071First seen Aug 13, 2026

CVE-2026-32639 is a broken access control vulnerability in the Winter CMS backend Theme Editor, specifically in Cms\Controllers\Index. The flaw allows a backend user who holds any single Theme Editor-related permission to bypass intended granular authorization boundaries between template types. As a result, AJAX handlers associated with template operations do not consistently enforce per-template-type permission checks, enabling cross-template actions outside the user’s assigned scope. The issue also affects asset handling by allowing unauthorized file uploads into the active theme asset directory when asset-related access validation is insufficient.

CVE-2026-32639First seen Aug 13, 2026

CVE-2026-46369 is an off-by-one error in the validity store logic of nimiq-blockchain. The flaw allows the same previously signed transaction to be accepted again within a limited contiguous block window, resulting in unintended duplicate processing of that transaction. Because transaction validity tracking fails to correctly prevent reuse in this edge case, a transaction that should have been rejected as already processed can instead be replayed and executed a second time.

CVE-2026-46369First seen Aug 13, 2026

CVE-2026-52776 is a server-side request forgery vulnerability in compliance-trestle affecting the URLSecurityValidator logic used during remote retrieval of OSCAL artifacts. The validator’s network filtering can be bypassed by supplying IPv4-mapped IPv6 literal addresses and the unspecified IPv4 address range beginning with 0.0.0.0, allowing destinations intended to be blocked to pass validation. As a result, attacker-controlled or attacker-influenced artifact references can cause the application to issue requests to internal or otherwise restricted endpoints, undermining the intended allowlist and network safety checks.

CVE-2026-52776First seen Aug 13, 2026

CVE-2026-47132 is an authenticated SQL injection issue in phpMyFAQ affecting the chat user search functionality exposed through the chat user search API endpoint. The flaw arises from improper neutralization of special elements used in SQL LIKE pattern matching, allowing attacker-supplied wildcard characters to alter the intended search semantics. Instead of being constrained to the expected display-name filter behavior, crafted input can broaden matching conditions and bypass the intended restriction logic. Successful exploitation enables enumeration of active chat users and disclosure of associated identity information.

CVE-2026-47132First seen Aug 13, 2026

CVE-2026-32593 is an SQL injection vulnerability in Winter CMS affecting the Backend Filter widget's numberrange scope through the numbersFromAjax AJAX handler. The flaw can be reached when a backend list view includes a vulnerable third-party plugin filter scope, allowing attacker-controlled input to be incorporated into SQL queries without sufficient sanitization or parameterization. The issue is not exploitable in a default vanilla installation without the relevant plugin-provided filter scope. Successful exploitation enables an authenticated backend user to manipulate database queries issued by the application.

CVE-2026-32593First seen Aug 13, 2026

CVE-2026-48786 is an information disclosure vulnerability in Fleet in which authenticated low-privilege users can use the target search endpoint to access sensitive team configuration data that should be masked or restricted. Users assigned Observer-class roles, including Observer, Observer+, and Technician, can retrieve unmasked team enroll secrets as well as credential-bearing team agent options. Exposed data may include secrets used for host enrollment and operational credentials embedded in team configuration. The flaw results from insufficient protection of sensitive information returned by the endpoint to users with limited privileges.

CVE-2026-48786First seen Aug 13, 2026

CVE-2026-12074 is a path traversal vulnerability in the Natural Language Toolkit (NLTK) FrameNet corpus reader. The flaw affects FramenetCorpusReader.frame(), which can be induced to resolve XML files outside the intended corpus root, bypassing the nltk.pathsec sandbox even when enforcement is enabled. By supplying attacker-influenced input that manipulates the resolved path, an attacker can cause the application to open and parse arbitrary XML files accessible to the running process rather than only FrameNet corpus content. Related code paths in document and lexical-unit loading are also noted as potentially reachable when a malicious or attacker-modified FrameNet corpus index is used.

CVE-2026-12074First seen Aug 1, 2026

CVE-2026-12075 is a server-side request forgery vulnerability in the Natural Language Toolkit (NLTK) URL handling protections implemented in `nltk.pathsec.urlopen`. A DNS rebinding condition allows an attacker to bypass the library's SSRF filtering logic, including documented `ENFORCE` mode protections. The issue affects code paths that rely on `nltk.pathsec` for URL safety, including `nltk.download` and `nltk.data.load`. By supplying a crafted URL that resolves benignly during validation and then rebinds to a prohibited internal destination at request time, an attacker can cause the application to issue HTTP requests to internal-only resources that the protection layer was intended to block.

CVE-2026-12075First seen Aug 1, 2026

CVE-2026-12072 is a path traversal vulnerability in NLTK's NKJPCorpusReader. The flaw allows attacker-controlled values supplied to the fileids argument of public read methods to escape the intended corpus root and access files outside the expected directory boundary. The issue bypasses NLTK path validation and the nltk.pathsec sandbox even when enforcement is enabled. The header() method can directly disclose contents of files outside the corpus root, and other reader methods can likewise open and read out-of-root files.

CVE-2026-12072First seen Aug 1, 2026

CVE-2026-12061 is a regular expression denial-of-service vulnerability in NLTK's ReviewsCorpusReader. The issue is caused by the FEATURES regular expression used while parsing review corpus content. A crafted review line that omits the expected bracketed structure can trigger quadratic backtracking in the regex engine, causing excessive CPU consumption during parsing. The vulnerable behavior affects methods that process the corpus through this parser, including reviews(), features(), and sents().

CVE-2026-12061First seen Aug 1, 2026

CVE-2026-21541First seen Jul 30, 2026

CVE-2025-48557First seen Jul 30, 2026

CVE-2025-64540First seen Jul 30, 2026