CVE-2026-89251

AVideo Missing Authorization via AD_Server log.php Wallet Credit

AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate ad impressions in plugin/AD_Server/log.php, allowing logged-in users to submit arbitrary label values that trigger unverified wallet credits to campaign video owners. Attackers can repeatedly POST label=start requests to mint YPTWallet balance for any campaign video without proof an ad actually played.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Wwbn

Products

Avideo

CVE-2026-89258

Hugo before v0.165.0 Symlink Confinement Bypass via resources.Get

Hugo is a static site generator. In versions after v0.123.0 and before v0.165.0, symlinks in parent directories were not dropped during direct resource lookups, allowing path confinement to be bypassed. An attacker who can place — or who convinces a site author to place — a symlink inside a mounted directory (for example, in a locally vendored theme under themes/) can cause functions that perform direct lookups, such as resources.Get and os.ReadFile, to follow that symlink and read files outside the intended project boundaries, disclosing their contents in the built site. Themes mounted as Go modules fetched from GitHub have symlinks stripped on download and are not affected, and multi-directory walks (e.g. content/asset walking) are not affected. This issue is an incomplete-fix follow-up to GHSA-c3wq-j5vh-68rc and GHSA-fw87-fv5r-9fpw; it is fixed in v0.165.0.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Gohugo

Products

Hugo

CVE-2026-19004

MongoDB BI Connector ODBC Driver Memory-Safety Issue When Handling Stored Procedure Output Parameters

An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue requires connecting to an untrusted or impersonated database server that returns crafted metadata. This may result in process termination, disclosure of process memory, or, under certain conditions, arbitrary code execution.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Bi Connector Odbc Driver

CVE-2026-81532

BI Connector ODBC Driver Improper Bounds Checking on Cursor Name Leading to Memory Corruption

A user able to submit SQL through an application using the MongoDB Connector for BI ODBC driver can supply a positioned-cursor statement whose cursor name exceeds the size of an internal fixed-length buffer. Because the name length is not bounded before the driver builds its diagnostic message, memory adjacent to that buffer is overwritten with user-supplied content. This can terminate the hosting application process and may allow unintended code to run within it.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Bi Connector Odbc Driver

CVE-2026-19003

MongoDB BI Connector ODBC driver may write outside an allocated buffer when the setup dialog opens a data source with oversized path settings

A data source definition containing an over-length file path setting may cause the MongoDB BI Connector ODBC Driver setup dialog to write outside the bounds of an allocated buffer. The issue stems from an incorrect buffer capacity calculation in the dialog's file and folder selection handling, and is reached only when a user opens the setup dialog for such a data source and initiates a file or folder selection. Depending on build configuration, the result may range from abnormal process termination to, under certain conditions, execution of unintended code in the context of the user running the dialog.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Bi Connector Odbc Driver

CVE-2026-19001

MongoDB BI Connector ODBC driver may write outside an allocated buffer when handling oversized catalog object names

The MongoDB BI Connector ODBC Driver may write outside the bounds of a fixed-size buffer when an application supplies an unusually long catalog, schema, or object name to a metadata retrieval function. This may result in memory corruption within the calling application's process, leading to abnormal termination and, under certain conditions, the potential for arbitrary code execution.

CVSS 4.0 · 9.5 Critical EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Bi Connector Odbc Driver

CVE-2026-81533

MongoDB BI Connector ODBC Driver Memory-Safety Issue When Parsing Oversized LIMIT Values

An application using the MongoDB BI Connector ODBC Driver may encounter a memory-safety issue when a submitted SQL statement contains an unusually long run of digits following a LIMIT clause. The issue occurs only on connections where the driver's optional prefetch setting is enabled, and stems from the driver copying the digit sequence into a fixed-size internal buffer without checking its length. A user able to influence the numeric portion of a LIMIT clause could cause the hosting application process to terminate unexpectedly or corrupt adjacent memory in that process.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Bi Connector Odbc Driver

CVE-2026-19002

Crafted database metadata may cause memory corruption in MongoDB BI Connector ODBC Driver

A missing bounds check when parsing stored procedure parameter metadata in the MongoDB BI Connector ODBC Driver can result in an out-of-bounds write in the client application process. Triggering this issue requires control over the server the driver connects to, or the ability to respond in its place, in order to return malformed metadata. The resulting memory corruption may cause the client application to terminate abnormally or, under certain conditions, execute unintended code.

CVSS 4.0 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Bi Connector Odbc Driver

CVE-2026-18888

MongoDB BI Connector ODBC driver may write outside an allocated buffer when retrieving large floating point values as character data

The MongoDB BI Connector ODBC Driver converts floating point column values into text without checking that the result fits within the destination buffer. When an application reads a sufficiently large floating point value as text, the driver may write beyond the end of that buffer and corrupt adjacent memory. A user who can store data in a collection read through the BI Connector could use this to crash the application performing the read.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

Bi Connector Odbc Driver

CVE-2026-66016

Rendered Artifactory Helm manifests may contain generated TLS private keys

Under specific self-hosted Helm configurations, generated TLS private keys may be retained in rendered manifests accessible to highly privileged local users.

CVSS 3.1 · 6.7 Medium EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-69105

Potential package cache integrity issue in JFrog Artifactory

An unauthenticated attacker may cause untrusted package content to be cached under specific conditions, potentially affecting artifact integrity and availability.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-69107

Potential unauthorized artifact access in JFrog Artifactory

An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-70547

Potential unauthorized metadata exposure in JFrog Artifactory

An authenticated user without repository read permission may access package metadata under specific conditions.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jfrog

Products

Artifactory

CVE-2026-76240

stigmem Postgres SQL Injection via Schema Identifier

stigmem-node 0.9.0a1 interpolates Postgres backend schema identifiers into SQL strings without defensive quoting. In the affected code path the schema value is operator-controlled, but the unsafe pattern could allow SQL injection if a schema name were derived from tenant, request, or user input. Fixed in 0.9.0a2, which adds identifier quoting and validation. As a workaround, only configure schema names from trusted deployment configuration.

CVSS 4.0 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Eidetic-labs

Products

Stigmem

CVE-2026-76245

stigmem Federation Peer Token Timestamp Validation Bypass

stigmem (pip package stigmem-node) version 0.9.0a1 contains a timestamp-handling mismatch in federation peer-token validation that can cause valid peer tokens to be incorrectly treated as expired. This affects the availability and reliability of authenticated federation flows on nodes using federation peer authentication paths. The issue is fixed in 0.9.0a2, which uses the canonical millisecond-based validation path.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Eidetic-labs

Products

Stigmem

CVE-2026-76242

stigmem Federation Peer Registration Authentication Bypass

stigmem-node 0.9.0a1 accepts federation peer key material during peer registration without a separate administrator out-of-band fingerprint approval step. On nodes that accept federation peer registration over a network where initial registration can be intercepted or misdirected, an attacker can register a malicious peer and gain access to or tamper with federation traffic. Fixed in 0.9.0a2, which introduces a pending approval flow requiring administrator fingerprint verification before peer tokens are accepted.

CVSS 4.0 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Eidetic-labs

Products

Stigmem

CVE-2026-82468

Rodauth before 2.47.0 CSRF Protection Bypass via Content-Type

Rodauth before 2.47.0 contains a cross-site request forgery protection bypass vulnerability in the JSON request content type validation. Attackers can craft cross-origin form posts with content types containing application/json substrings to bypass CSRF token validation and force victims to authenticate to attacker-controlled accounts.

CVSS 4.0 · 4.9 Medium EPSS < 1% KEV · Not listed

Vendors

Jeremyevans

Products

Rodauth

CVE-2026-89066

OS command injection in the task synthesis component in projen

Improper neutralization of special elements used in an OS command in the task synthesis component in projen before 0.103.0 might allow context-dependent attackers to execute arbitrary commands on a developer workstation or continuous integration runner via shell metacharacters in project configuration values and repository file names that are interpolated into generated task definitions. To remediate this issue, users should upgrade to version 0.103.0 and then re-synthesize the project so that .projen/tasks.json is regenerated with the corrected task definitions. Upgrading alone is not sufficient because the generated task definition file is committed to the repository.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Aws

Products

Projen

CVE-2026-16033

Arbitrary file read+write on host via templates/ symlink in malicious image

A path traversal vulnerability in LXD allows an attacker to achieve arbitrary host file read or unconstrained file creation. When processing image metadata templates, LXD fails to properly sanitize or restrict template file paths from escaping the instance templates directory (specifically affecting virtual machine / QEMU driver execution paths). An attacker can exploit this flaw by providing a crafted image archive with malicious template directives containing path traversal sequences, causing LXD to access or write files outside the intended template directory on the host system.

CVSS 3.1 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Canonical

Products

Lxd

CVE-2026-86080

n8n: GitHub Trigger 422 Reuse Path Skips Webhook Secret Storage, Causing Signature Verification to Fail-Open

n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the GitHub Trigger generated a webhook secret but discarded it when GitHub returned HTTP 422 and the node reused an existing webhook. Workflow static data then retained webhookId without webhookSecret, and X-Hub-Signature-256 verification accepted deliveries without a stored secret. The affected logic includes packages/nodes-base/nodes/Github/GithubTriggerHelpers.ts and the 422 webhook reuse path. This issue is fixed in versions 1.123.76, 2.37.7 and 2.38.2.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

N8n

Products

N8n