Author name: UNDERCODE

CVE-2026-2836 is a cache poisoning vulnerability in the Pingora HTTP proxy framework caused by an insecure default cache key construction.

CVE-2026-1693 details a vulnerability in ARC Informatique’s PcVue product, specifically affecting versions 12.0.0 through 16.3.3. The core issue is the

The vulnerability arises from a discrepancy in how the `server-http` gateway and backend plugin handlers process HTTP request paths. The

CVE-2026-1695 is a Cross-Site Scripting (XSS) vulnerability residing in the OAuth web services component of ARC Informatique’s PcVue software, specifically

When an OAuth2 bearer token is used for an HTTP or HTTPS transfer and curl follows a redirect to a

The vulnerability, identified as CVE-2026-30958, resides in OneUptime versions prior to 10.0.21. It is an unauthenticated path traversal flaw located

The vulnerability, assigned CVE-2025-58753, is a missing permission check in the Copyparty file server’s sharing feature (shr global-option) . It

CVE-2026-29195 is an incorrect authorization vulnerability in the user update handler of Netmaker, a platform for creating virtual private networks

libcurl maintains a pool of network connections to reuse for subsequent requests, avoiding the overhead of creating new connections. When

The vulnerability, identified as CVE-2026-26284, exists in the `BilateralBlurImage` function of ImageMagick . It is a heap buffer over-read caused

When doing a second SMB request to the same host again, curl would wrongly use a data pointer pointing into

The vulnerability arises from the default configuration of Microsoft IIS and ASP.NET, which automatically add specific HTTP headers to web

The vulnerability, identified as CVE-2026-30931, is a heap-based buffer overflow found in the UHDR encoder of ImageMagick. The issue stems

The ha-mcp OAuth consent form, a beta feature, accepts a user-supplied `ha_url` and makes an unvalidated server-side HTTP request to

The vulnerability resides in OliveTin’s live EventStream feature, which broadcasts real-time updates about action executions to all authenticated users currently

CVE-2026-3483 is a high-severity vulnerability in Ivanti Desktop and Server Management (DSM) that allows local authenticated attackers to escalate their

The vulnerability resides in the Microsoft Teams plugin’s message handler logic. When a system administrator configures a route allowlist for

The vulnerability stems from a flaw in libcurl’s connection reuse logic when communicating with HTTP proxies that require authentication. When

CVE-2026-30957 is a critical vulnerability in OneUptime versions prior to 10.0.21. The issue lies in the Synthetic Monitors feature, where

A heap buffer overflow vulnerability exists in ImageMagick’s WriteXWDImage function, specifically due to a 32-bit unsigned integer overflow in the

How This CVE Works OneUptime versions before 10.0.20 contain a critical Remote Code Execution vulnerability in their Synthetic Monitors feature

The vulnerability resides in Nuxt’s `useHeadSafe` utility, specifically within the `makeTagSafe` function in `safe.ts` (lines 68-71). This function is designed

The vulnerability, identified as CVE-2026-30959, resides in the `resend-verification-code` endpoint of OneUptime, an open-source observability platform . The core issue

The vulnerability, identified in OpenClaw versions up to 2026.2.25, is a sandbox bypass caused by improper validation of symbolic links

The ha-mcp OAuth consent form prior to version 7.0.0 renders user-controlled parameters using Python f-strings without HTML escaping, creating a

The vulnerability resides in the skill installation process of OpenClaw versions up to 2026.3.7. The installer validates the intended per-skill

Parse Server versions prior to 8.6.35 and 9.6.0-alpha.9 contain a vulnerability in the LiveQuery feature . The issue arises because

How CVE-2026-1692 Works This vulnerability stems from a missing origin validation in WebSockets, specifically affecting the GraphicalData web services of

CVE-2026-1696 is a vulnerability in arcinfo PcVue’s web server components (WebVue, WebScheduler, TouchVue, SnapVue) where specific HTTP security headers are

The vulnerability exists in the `WaveletDenoiseImage` method, which is called when ImageMagick processes an image with the `-wavelet-denoise` command-line option.

A heap buffer overflow vulnerability exists in ImageMagick’s `ReadYUVImage()` function within `coders/yuv.c` when processing maliciously crafted YUV 4:2:2 images with

A signed integer overflow vulnerability, identified as CVE-2026-25970, exists in ImageMagick’s SIXEL decoder, specifically affecting versions prior to 7.1.2-15 and

The vulnerability, identified as CVE-2026-25982, is a heap out-of-bounds read flaw found in ImageMagick’s DICOM decoder within `coders/dcm.c` . It

A stack buffer overflow vulnerability, identified as CVE-2026-25968, exists in ImageMagick’s handling of Magick Scripting Language (MSL) files . The

ImageMagick fails to check for circular references between two Magick Scripting Language (MSL) files . When a specially crafted MSL

CVE-2026-28442 is a high-severity vulnerability in ZimaOS version 1.5.2-beta3, a fork of CasaOS designed for Zima devices and x86-64 systems

CVE-2026-27275 is a critical vulnerability affecting Adobe Substance 3D Stager versions 3.1.7 and earlier. It is an out-of-bounds write issue,

CVE-2026-27269 is an out-of-bounds read vulnerability affecting Adobe Premiere Pro versions 25.5 and earlier. The flaw exists in how the

CVE-2026-1427 is an OS Command Injection vulnerability found in the Single Sign-On Portal System developed by WellChoose . This security

CVE-2026-30832 details a critical Server-Side Request Forgery (SSRF) vulnerability in Charmbracelet’s Soft Serve, a self-hostable Git server . The flaw

The HTTP service in Tapo C220 v1 and C520WS v2 cameras fails to safely handle POST requests with an excessively

Values passed to the domain, path, and `samesite` arguments of `RequestHandler.set_cookie` were not completely validated in versions of Tornado prior

The vulnerability resides in mchange-commons-java, a utility library often used with the c3p0 connection pool. The library contains an independent

CVE-2026-29786 is a high-severity vulnerability in the `node-tar` library, a package used for creating and extracting Tar archives in Node.js

The HTTP parser in Tapo C220 v1 and C520WS v2 cameras contains a flaw in its error-handling logic. When the

CVE-2025-9520 is an Insecure Direct Object Reference (IDOR) vulnerability found in Omada Controllers . It resides in the software’s authorization

The vulnerability, CVE-2026-27900, resides in how the Terraform Provider for Linode handled debug logging prior to version 3.9.0 . The

CVE-2026-27821 is a high-severity vulnerability found in GPAC, an open-source multimedia framework . The flaw is a stack-based buffer overflow

The vulnerability in CVE-2026-29787 resides within the mcp-memory-service, an open-source memory backend for multi-agent systems . Prior to version 10.21.0,

CVE-2026-1429 is a reflected cross-site scripting vulnerability found in the Single Sign-On Portal System developed by WellChoose . The vulnerability

The vulnerability, known as a Zip Slip attack, exists in the `jaraco.context.tarball()` function from version 5.2.0 up to, but not

The vulnerability stems from a design flaw in the configuration export within uptime.config.ts. This file exported two objects: `pageConfig` (intended

CVE-2025-9522 is a Blind Server-Side Request Forgery (SSRF) vulnerability affecting TP-Link Omada Controllers . The flaw resides specifically within the

The Single Sign-On Portal System developed by WellChoose contains an OS Command Injection vulnerability, identified as CVE-2026-1428 and classified under

The vulnerability in pyLoad, identified as CVE-2026-29778, resides in the `edit_package()` function found within the `json_blueprint.py` file. This function handles

CVE-2025-9521 is a vulnerability in TP-Link Omada Controllers that allows an attacker with a valid session token to bypass the

The vulnerability, designated CVE-2026-1315, resides in the firmware update mechanism of TP-Link Tapo C220 v1 and C520WS v2 cameras .

CVE-2026-29781 is a vulnerability in the Sliver command and control framework that resides in the Protobuf unmarshalling logic . The

On March 3, 2026, an attacker used compromised credentials to create pull requests injecting obfuscated shell code into the `xygeni/xygeni-action`

The vulnerability, identified in n8n workflow automation platform versions from 0.211.0 up to, but not including, 1.120.4, 1.121.1, and 1.122.0,

The vulnerability resides in how Sylius handles HTTP redirects. Three specific components—CurrencySwitchController::switchAction(), ImpersonateUserController::impersonateAction(), and StorageBasedLocaleSwitcher::handle()—trust the HTTP Referer header without

CVE-2026-31809 describes a reflected Cross-site Scripting (XSS) vulnerability in SiYuan versions prior to 3.5.10 due to an improper sanitization of

CVE-2026-27273 is a high-severity vulnerability affecting Adobe Substance 3D Stager versions 3.1.7 and earlier . The flaw is classified as

CVE-2026-27219 is an Out-of-bounds Read vulnerability affecting Adobe Substance 3D Painter versions 11.1.2 and earlier. The flaw resides in how

A critical SQL injection vulnerability, identified as CVE-2026-31871, exists in Parse Server versions prior to 8.6.31 and 9.6.0-alpha.5 when using

The vulnerability stemmed from incorrect state handling during nested EVM execution paths involving the ICS20 precompile . Under specific execution

The vulnerability, identified as CVE-2026-31833, is a stored cross-site scripting (XSS) issue found in Umbraco CMS versions 16.2.0 up to

The vulnerability arises from how Parse Server handles dot-notation in query `WHERE` clauses and `sort` parameters when class-level permissions (CLPs)

The vulnerability exists in the Argo Workflows server endpoints for WorkflowTemplates and ClusterWorkflowTemplates. The server lacks proper authorization checks on

The vulnerability, identified as CVE-2021-32711, resides in the Store-API of Shopware platforms, specifically within the `store-api.order` endpoint which utilizes a

The league/commonmark library, a PHP Markdown parser, prior to version 2.8.1 contains a vulnerability in its DisallowedRawHtml extension. This extension

The vulnerability in Quill before version v0.7.1 stems from insufficient validation of size fields when parsing Mach-O binaries. Specifically, during

CVE-2026-21363 is a NULL Pointer Dereference vulnerability affecting Adobe Substance 3D Painter versions 11.1.2 and earlier. The vulnerability exists within

CVE-2026-31807 details a reflected Cross-site Scripting (XSS) vulnerability in SiYuan, a personal knowledge management system, versions prior to 3.5.10. The

A high-severity integrity bypass vulnerability, identified as CVE-2026-31839, existed in Striae’s digital confirmation workflow prior to version 3.0.0 . Striae

The vulnerability stems from incorrect default permissions (CWE-276) within .NET 10.0 on Linux systems. During the packaging process of .NET

The vulnerability, identified as CVE-2025-70238, is a stack-based buffer overflow found in the D-Link DIR-513 router running firmware version 1.10.

Parse Server versions prior to 8.6.33 and 9.6.0-alpha.7 contain a vulnerability in the Multi-Factor Authentication (MFA) implementation. When MFA via

The vulnerability exists in the challenge-based authentication for the local gRPC client API used by Anytype Desktop and Anytype-CLI. The

The vulnerability exists in the Craft CMS conditions system, specifically within the `BaseElementSelectConditionRule::getElementIds()` method. This method passes user-controlled string input

The vulnerability resides in how Adobe Substance3D Painter versions 11.1.2 and earlier handle specific file structures during the parsing process.

This vulnerability is a vertical privilege escalation flaw in Umbraco CMS. It occurs because the application fails to properly enforce

PinchTab is a standalone HTTP server that gives AI agents direct control over a Chrome browser. Prior to version 0.7.7,

CVE-2026-27274 is a high-severity vulnerability affecting Adobe Substance 3D Stager versions 3.1.7 and earlier. This flaw is classified as an

The vulnerability is a stored Cross-Site Scripting (XSS) issue found in the Craft CMS control panel. It resides in the

The vulnerability exists in Shescape versions prior to 2.1.10 because the `escape()` function fails to escape square brackets ([ and

How the CVE Works: The vulnerability resides in Quill versions prior to v0.7.1, specifically in the function that fetches Apple

The vulnerability lies in the `/verificationEmailRequest` endpoint of Parse Server. When email verification is enabled (verifyUserEmails: true), the endpoint’s behavior

The CVE-2025-70250 vulnerability is a stack-based buffer overflow residing in the D-Link DIR-513 router specifically on firmware version 1.10. The

CVE-2026-27218 is a NULL Pointer Dereference vulnerability found in Adobe Substance 3D Painter versions 11.1.2 and earlier . This type

Substance 3D – Painter versions 11.1.2 and earlier are affected by a NULL Pointer Dereference vulnerability (CWE-476) that could lead

Quill is a tool for signing and notarizing macOS binaries from any platform . During the Apple notarization process, it

The vulnerability stems from three combined issues in Argo Workflows’ handling of `podSpecPatch` when `templateReferencing: Strict` is enabled. First, the

CVE-2026-27216 is a vulnerability affecting Adobe Substance 3D Painter, a popular 3D texturing software . The issue is classified as

CVE-2025-70243 is a critical stack-based buffer overflow vulnerability discovered in the D-Link DIR-513 router running firmware version v1.10. The issue

CVE-2026-27215 is a vulnerability found in Adobe Substance 3D Painter versions 11.1.2 and earlier. It is classified as a NULL

The vulnerability, identified as CVE-2026-29777, exists in Traefik’s Kubernetes Gateway provider. It stems from improper neutralization of special elements used

CVE-2026-27214 is a NULL Pointer Dereference vulnerability affecting Adobe Substance 3D Painter versions 11.1.2 and earlier. This flaw occurs when

The vulnerability, identified as CVE-2026-26130, is a Denial of Service (DoS) flaw residing in ASP.NET Core, a cross-platform framework for

How the mentioned CVE works: The vulnerability resides in Shopware’s legacy app registration flow that uses HMAC-based authentication. During the