CVE-2026-79831

HPE NonStop Posix User Threads - Heap buffer overflow vulnerability

A heap buffer overflow in HPE NonStop Posix User Threads may allow arbitrary code execution.

CVSS 3.1 · 6.6 Medium EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Posix User Threads

CVE-2026-79832

HPE NonStop SQL/MX Executor - Buffer overflow vulnerability

A stack buffer overflow vulnerability in HPE NonStop SQL/MX Executor may potentially result in information disclosure or process crash.

CVSS 3.1 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Sql/mx Executor

CVE-2026-79833

HPE NonStop ANSI SQLUTIL - Denial of Service vulnerability

A vulnerability in HPE NonStop ANSI SQLUTIL may allow a remote unauthenticated actor to cause an affected service to terminate unexpectedly, causing a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Ansi Sqlutil

CVE-2026-79834

HPE NonStop SQL/MX SQLCAT - Unauthorized command execution vulnerability

A security vulnerability in HPE NonStop SQL/MX SQLCAT may allow an unauthenticated user to perform unauthorized command execution.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Sql/mx Sqlcat

CVE-2026-79836

HPE NonStop SQL/MX Run-Time Statistics - Information disclosure and DoS vulnerability

A vulnerability HPE NonStop SQL/MX Run-Time Statistics may allow an attacker to cause memory corruption and null pointer dereference, potentially leading to process crash,  DoS or information disclosure.

CVSS 3.1 · 6.4 Medium EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Sql/mx Run-time Statistics

CVE-2026-79837

HPE NonStop SQL/MX UDR SERVER - Service disruption vulnerability

A vulnerability in HPE NonStop SQL/MX UDR SERVER may allow a crafted message to cause process termination, service disruption or memory corruption, resulting in undefined behavior.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Hpe

Products

Nonstop Sql/mx Udr Server

CVE-2026-55876

Helium: Stored XSS via Unrestricted SVG File Upload — Authenticated Users Can Store Executable Scripts

Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, the POST /planner/attachments/ endpoint allows authenticated users to upload SVG and HTML attachments because conf/configs/common.py omits those formats from BLOCKED_ATTACHMENT_EXTENSIONS and BLOCKED_ATTACHMENT_MIME_TYPES, and helium/planner/serializers/attachmentserializer.py relies on those blocklists. An uploaded SVG served as image/svg+xml can execute embedded script when a visitor opens its public attachment URL, allowing persistent attacker-controlled active content and phishing under an application-managed storage URL. The attachment storage uses a separate origin from the application, so same-origin policy prevents the script from reading application cookies or storage, and application-session compromise is not supported by the maintained deployment configuration. This issue is fixed in version 2.2.60.

CVSS 3.1 · 3.5 Low EPSS < 1% KEV · Not listed

Vendors

Heliumedu

Products

Platform

CVE-2026-55875

Helium: SSRF via External Calendar URL Allows Authenticated Users to Probe Internal Network

Helium is a free online student planner for classes, homework, grades, and notes. Prior to 2.2.60, any authenticated user can submit an arbitrary URL to POST /feed/externalcalendars/, where helium/feed/services/icalexternalcalendarservice.py uses validate_url to check only URL syntax before passing the value to urllib.request.urlopen, and fetch_ical_conditional periodically refetches the stored URL. The server can therefore issue requests to attacker-selected external or internal hosts, while distinct responses, including an uncaught http.client.RemoteDisconnected condition for non-HTTP services, reveal internal host and port reachability. The supported impact is forced outbound requests and internal service reconnaissance; the advisory does not demonstrate secret retrieval because the relevant ECS credentials path is task-specific and unpredictable. This issue is fixed in version 2.2.60.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Heliumedu

Products

Platform

CVE-2026-55871

GYM One: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in admin/users/index.php

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php concatenates the search_name and search_email GET parameters into both the user-list query and the COUNT query used for pagination without prepared statements. An authenticated administrator can inject SQL through either search field to read data from arbitrary tables, including user information and password hashes. Depending on database permissions, the same injection may also permit filesystem writes. This issue is fixed in version 1.4.1.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mayerbalintdev

Products

Gym-one

CVE-2026-55872

GYM One admin user list is vulnerable to stored cross-site scripting

GYM One is open-source gym management software for fitness centers, personal trainers, and sports clubs. Prior to 1.4.1, GYM One's admin/users/index.php renders the stored firstname, lastname, and email profile fields into the administrator user list without HTML output encoding. An attacker who can store values in those fields can cause content to execute in an administrator's browser when the administrator visits /admin/users/. The persistent script can access administrator-session data or perform actions with the administrator's privileges until the stored record is removed. This issue is fixed in version 1.4.1.

CVSS 3.1 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Mayerbalintdev

Products

Gym-one

CVE-2026-111158

EarthScope libmseed through 3.5.4 Heap Out-of-Bounds Read via ms3_detect

EarthScope libmseed through 3.5.4 contains a heap out-of-bounds read vulnerability in ms3_detect() in parseutils.c that reads past truncated miniSEED 2 record buffers. Attackers can supply a 40 to 47 byte buffer passing MS2_ISVALIDHEADER to msr3_parse() or ms3_detect(), over-reading up to 8 bytes and potentially crashing the process.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Earthscope

Products

Libmseed

CVE-2026-111161

libADLMIDI 1.6.2 through 1.6.2.1 Stack Out-of-Bounds Write via BW_MidiSequencer noteStates

libADLMIDI 1.6.2 through 1.6.2.1 contains an off-by-one stack out-of-bounds write vulnerability in BW_MidiSequencer that allows attackers to corrupt stack memory via crafted MIDI files. Attackers can supply a MIDI file with a note-on using status 0x9F and note 0x7F through adl_openFile() or adl_openData() to crash the hosting media player or game engine.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Wohlstand

Products

Libadlmidi

CVE-2026-111164

UADE through 3.05 Out-of-Bounds Read in uade_filemagic via Short Module

UADE through 3.05 contains an out-of-bounds read vulnerability in uade_filemagic() in amifilemagic.c caused by unsigned bufsize subtraction wrapping on short inputs. Attackers can supply a crafted short module that passes format probe bounds checks and reads far past the buffer, crashing applications that probe or play it.

CVSS 4.0 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Uade

Products

Uade

CVE-2026-111170

kedro-datasets 9.3.0 through 9.6.0 Path Traversal via MatplotlibDataset Plot Name

kedro-datasets from 9.3.0 through 9.6.0 contains a path traversal vulnerability in MatplotlibDataset.save() that allows attackers to write files outside the dataset directory by supplying absolute plot names. Because validate_sub_path() strips leading slashes while pathlib's join discards the base path, attackers can create or overwrite files anywhere the process can write.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Kedro-org

Products

Kedro-datasets

CVE-2026-111172

@casl/ability 6.7.5 before 7.0.2 Prototype Pollution via rulesToFields setByPath

@casl/ability 6.7.5 before 7.0.2 contains a prototype pollution vulnerability in rulesToFields() that allows attackers to modify inherited builtins via dotted condition keys. Attackers controlling rule conditions can supply keys like 'toString.call' to alter shared builtin functions process-wide, causing denial of service for the Node.js process.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Stalniy

Products

Casl

CVE-2026-108126

temporal-proxy payload decryption is not bound to the request namespace

temporal-proxy 0.2.0 through 0.8.0 does not bind encrypted payloads to the namespace they were encrypted for. When payload encryption is enabled, the proxy chooses the decryption key by an identifier stored in the payload rather than by the namespace of the request, and nothing in the ciphertext records that namespace. A caller whom the proxy authorizes only for namespace B, and who has obtained an encrypted payload from namespace A, can therefore have the proxy decrypt it. In 0.8.0, the caller can submit the payload to the codec server's /decode endpoint. In every affected version, a caller who can also write to namespace B on the Temporal server directly can place the payload there and read it back through the proxy. This holds whether namespaces share the default key or each has its own, because a single proxy holds every key it is configured with. The issue does not give the attacker encrypted payloads they could not already obtain, and does not allow encrypted payloads to be modified.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Temporal

Products

Temporal-proxy

CVE-2026-94134

Apache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default

The Apache Airflow SSH provider hook disables SSH host-key verification by default: unless `host_key` is configured or `no_host_key_check` is explicitly set to false, it accepts any server key. This affects SSH and SFTP connections that rely on the default. An attacker in a machine-in-the-middle position between the worker and the SSH or SFTP server can impersonate the server and capture the credentials or data a task sends. Users of apache-airflow-providers-ssh and apache-airflow-providers-sftp are recommended to upgrade to apache-airflow-providers-ssh 7.0.0 and apache-airflow-providers-sftp 7.0.0 or later. The deferrable SFTP code paths had the same default and are covered separately by CVE-2026-94135; apache-airflow-providers-sftp 7.0.0 fixes both.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Apache

Products

Airflow Sftp Provider Airflow Ssh Provider

CVE-2026-111275

nifti_clib through 3.0.1 Stack Out-of-Bounds Access via nifti_convert_n2hdr2nim

nifti_clib through 3.0.1 contains a stack-based out-of-bounds read and write vulnerability in nifti_convert_n2hdr2nim() because the NIfTI-2 dim[0] value is never range-checked. Attackers can supply a crafted 540-byte NIfTI-2 header read via nifti_image_read() to crash applications or corrupt stack memory.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Nifti-imaging

Products

Nifti Clib

CVE-2026-111283

BMC Helix Network Management 26.3.00 before 26.3.01 Authentication Bypass via SAML Configuration

BMC Helix Network Management on-prem 26.3.00 before 26.3.01 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as the local administrator with any password when SAML single sign-on is configured. Attackers can submit the administrator username with an arbitrary password on the web login page to obtain a SuperAdmin session, modify device credentials, run device commands, and alter audit records.

CVSS 4.0 · 9.5 Critical EPSS < 1% KEV · Not listed

Vendors

Bmc Helix

Products

Bmc Helix Network Management

CVE-2026-111312

OpenHealth through 0.2.0 Missing Authentication via /api/health-data/[id] Route

OpenHealth through 0.2.0 contains a missing authentication and authorization vulnerability in the /api/health-data/[id] GET, PATCH and DELETE handlers that query records by id without session or authorId checks. Unauthenticated attackers who know a HealthData record id can read another user's medical record data and file metadata, overwrite it with arbitrary JSON, or delete it.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed

Vendors

Openhealthforall

Products

Openhealth