CVE-2026-127212

Dokploy < 0.31.1 Broken Access Control via readAppMonitoring

Dokploy before 0.31.1 contains a missing ownership check vulnerability in the readAppMonitoring tRPC procedure that allows authenticated attackers to access container metrics belonging to other organizations by supplying an arbitrary appName. Attackers can query getApplicationStats with any application name, including the fixed "dokploy" control-plane service name, to read CPU, memory, network I/O, and block I/O metrics for containers they do not own on self-hosted multi-tenant instances.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Dokploy

Products

Dokploy

CVE-2026-126358

Hono: RegExpRouter skips wildcard middleware for some route sets and for paths with an encoded line terminator

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.1.4 until 4.13.16, RegExpRouter can omit wildcard middleware in three version-specific cases: since 4.13.0, middleware using the explicit default parameter pattern in /api/:tenant{[^/]+}/admin/* is not applied to a route written as /api/:tenant/admin/:id; since 4.1.4, middleware on /admin/* is not applied to a route registered as /admin* for paths under /admin/; and since 4.4.0, a request path containing an encoded line terminator can reach the not-found handler without wildcard middleware. The default SmartRouter selects RegExpRouter for most applications, and the router's registration-time coverage calculation treated the first two matching pattern pairs as different while its compiled wildcard did not match line terminators in the third case. An unauthenticated client can reach a route handler or the not-found handler without authentication or authorization middleware registered on the wildcard path. TrieRouter, LinearRouter, and PatternRouter apply the middleware in the three described cases. This issue is fixed in version 4.13.16.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Hono

Products

Hono

CVE-2026-126359

Hono: `css` helper does not escape a closing tag split between the template and an interpolated value, allowing HTML injection

Hono is a Web application framework that provides support for any JavaScript runtime. From 3.12.0 until 4.13.16, the css helper in hono/css escapes interpolated string values separately and therefore fails to neutralize a closing style tag when &lt; ends the template text or a preceding value and / begins the next attacker-controlled value. During server-side rendering, the combined output can close the &lt;Style /&gt; element early and cause the remainder of the interpolated value to be interpreted as HTML. Applications that place an untrusted string immediately after &lt; in a css template, including adjacent untrusted interpolations, can expose viewers to attacker-controlled HTML or script and information accessible to that page. Other uses of the css helper are not affected. This issue is fixed in version 4.13.16.

CVSS 3.1 · 3.4 Low EPSS < 1% KEV · Not listed

Vendors

Hono

Products

Hono

CVE-2026-126360

OpenTelemetry Python: Denial of service through quadratic-time traceparent parsing in opentelemetry-api

OpenTelemetry Python provides the Python API and SDK for OpenTelemetry. Prior to 1.45.2, TraceContextTextMapPropagator.extract() in opentelemetry-api can perform quadratic-time regular-expression backtracking on a malformed traceparent value containing a trace-context prefix, a long whitespace sequence, and an embedded newline. Exploitation requires an attacker-controlled carrier that preserves embedded newlines and permits a sufficiently large value, because conforming HTTP header values cannot contain embedded newlines. JSON-based carriers, including applicable MCP request metadata integrations, can preserve the required newline depending on the SDK, instrumentation, and message-size limits. Parsing on an asynchronous server's event-loop thread can consume excessive CPU and delay unrelated requests, while the advisory does not establish disclosure, modification, or code execution. This issue is fixed in version 1.45.2.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Opentelemetry

Products

Opentelemetry-python

CVE-2026-126361

Astro: XSS via attribute injection in dynamic tag names

Astro is a web framework for content-driven websites. Prior to 7.4.5, Astro rendered a string used as a dynamic element name as raw HTML after applying an incomplete character filter. A / in the string could make an HTML parser treat the remainder as attributes, allowing untrusted element-name input to inject event-handler markup. The .astro dynamic-tag renderer, JSX renderer, and MDX renderer were affected, and exploitation required an application to use request-controlled or stored untrusted data as all or part of an element name. This issue is fixed in version 7.4.5.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Astro Withastro

Products

Astro Astro

CVE-2026-126362

Astro: Reflected XSS via unescaped slot names in @astrojs/svelte

Astro is a web framework for content-driven websites. From 5.7.3 until 9.1.2, the @astrojs/svelte renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. Request-controlled slot names containing a quote could terminate the attribute and inject active HTML. Exploitation required a hydrated Svelte component using a client:* directive and dynamic rendering of the attacker-chosen slot; components that did not render that slot emitted only Astro's escaped fallback content. Both server rendering and client-side hydration used the unsafe slot name. This issue is fixed in version 9.1.2.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Astro Withastro

Products

Astro Astro

CVE-2026-126363

Astro: Reflected XSS via unescaped slot names in @astrojs/solid-js

Astro is a web framework for content-driven websites. From 0.2.0 until 7.1.2, the @astrojs/solid-js renderer inserted a named slot into the quoted name attribute of an astro-slot wrapper without HTML escaping. A request-controlled slot name containing a quote could terminate the attribute and inject active HTML. Exploitation required a hydrated Solid component using a client:* directive and dynamic access to the attacker-chosen slot property; a component that did not render that slot emitted only escaped fallback content. This issue is fixed in version 7.1.2.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Astro Withastro

Products

Astro Astro

CVE-2026-93333

Vault audit device prefix vulnerable to log injection

Vault's audit devices did not validate the contents of a configured audit log prefix and did not consistently enforce the server-level setting that restricts audit log prefixing. This may allow a privileged operator to inject content into audit logs, potentially leading to forged or misleading audit records. This vulnerability (CVE-2026-93333) is fixed in Vault Community Edition 2.2.2 and Vault Enterprise 2.2.2, 1.21.14, and 1.19.25.

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Hashicorp

Products

Vault Vault Enterprise

CVE-2026-111335

Improper request handling can lead to a denial-of-service / reboot-loop condition in Citrix NetScaler ADC and Citrix NetScaler Gateway

Improper request handling can lead to a denial-of-service / reboot-loop condition in Citrix NetScaler ADC and Citrix NetScaler Gateway.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Citrix

Products

Gateway Netscaler Adc Netscaler Gateway

CVE-2026-111336

Memory overflow in HTTP/2 handling can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway

Memory overflow in HTTP/2 handling can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Citrix

Products

Gateway Netscaler Adc Netscaler Gateway

CVE-2026-111337

Memory overflow in Base64 decoding in advanced policy expressions leading to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway

Memory overflow in Base64 decoding in advanced policy expressions leading to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Citrix

Products

Gateway Netscaler Adc Netscaler Gateway

CVE-2026-111338

Sensitive authentication material written to a log file in Citrix NetScaler ADC and Citrix NetScaler Gateway

Sensitive authentication material written to a log file in Citrix NetScaler ADC and Citrix NetScaler Gateway.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Citrix

Products

Gateway Netscaler Adc Netscaler Gateway

CVE-2026-111339

Memory overflow in Application Firewall data decompression/inspection can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway

Memory overflow in Application Firewall data decompression/inspection can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Citrix

Products

Gateway Netscaler Adc Netscaler Gateway

CVE-2026-107524

Integer Overflow in Dell PowerStore Allows Authenticated Host to Cause Out‑of‑Bounds Data Access or Denial of Service

Dell PowerStore contains an integer overflow vulnerability. An authenticated storage host could exploit this vulnerability, potentially leading to out-of-bounds data access or denial of service.

CVSS 3.1 · 8.8 High EPSS n/a KEV · Not listed

Vendors

Dell

Products

Powerstore 1000t Powerstore 1200t Powerstore 3000t and 9 more

CVE-2026-111547

Out‑of‑Bounds Read Vulnerability in Dell PowerStore Systems

Dell PowerStore contains an out-of-bounds read vulnerability. An attacker could exploit this vulnerability, potentially leading to denial of service or limited information disclosure.

CVSS 3.1 · 8.1 High EPSS n/a KEV · Not listed

Vendors

Dell

Products

Powerstore 1000t Powerstore 1200t Powerstore 3000t and 9 more

CVE-2026-107523

Integer Overflow in Dell PowerStore Enables Volume Bounds Check Bypass

Dell PowerStore contains an integer overflow vulnerability. An adjacent attacker could exploit it to bypass volume bounds checks, potentially leading to data destruction or denial of service.

CVSS 3.1 · 8.7 High EPSS n/a KEV · Not listed

Vendors

Dell

Products

Powerstore 1000t Powerstore 1200t Powerstore 3000t and 9 more

CVE-2026-107522

Dell PowerStore Improper Authorization Leading to Privilege Escalation

Dell PowerStore contains an Improper Authorization vulnerability. An authenticated user could exploit this vulnerability, potentially leading to privilege escalation to administrator.

CVSS 3.1 · 7.2 High EPSS n/a KEV · Not listed

Vendors

Dell

Products

Powerstore 1000t Powerstore 1200t Powerstore 3000t and 9 more

CVE-2026-111545

SQL Injection Leading to Private Key Disclosure in Dell PowerStore Appliances

Dell PowerStore contains a SQL Injection vulnerability. An authenticated attacker could exploit this vulnerability, potentially leading to disclosure of stored private keys and tampering with trusted certificates.

CVSS 3.1 · 8.8 High EPSS n/a KEV · Not listed

Vendors

Dell

Products

Powerstore 1000t Powerstore 1200t Powerstore 3000t and 9 more

CVE-2026-126364

Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems

Astro is a web framework for content-driven websites. From 5.14.3 until 7.4.7, Astro's /_image endpoint compared the requested local-image path with the build output directory without preserving case on case-sensitive filesystems. A sibling directory whose path differed from the output directory only by letter case could therefore pass the containment check, allowing an unauthenticated requester to read image files accepted by the image service from outside the output directory. Exploitation required on-demand rendering with the @astrojs/node adapter, a case-sensitive filesystem, and a preexisting case-variant sibling directory; ordinary traversal to unrelated paths was already rejected. This issue is fixed in Astro version 7.4.7.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Astro Withastro

Products

Astro Astro

CVE-2026-126367

@grpc/grpc-js: safe_regex incorrectly applies partial string matching for patterns with alternation

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Before 1.13.2, and from 1.14.0 through 1.14.1, the @grpc/grpc-js-xds SafeRegexValueMatcher and PathSafeRegexValueMatcher add start and end anchors without grouping a supplied top-level alternation. An expression intended to match one of several complete values can therefore match a prefix, substring, or suffix. The affected matchers are used for route selection, xDS credential identity matching, and RBAC URL path, principal name, server name, and header rules. An ALLOW policy using an alternation can consequently accept a method, certificate identity, or header value outside the intended set, while a DENY policy becomes broader rather than permissive. This issue is fixed in versions 1.13.2 and 1.14.2.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Grpc

Products

Grpc-node