CVE-2026-102289

zizmor: Debug logging prints available GitHub credentials in cleartext

zizmor is a static analysis tool for CI/CD systems. In version 1.27.0, debug logging serializes the parsed application configuration with a derived Debug implementation for GitHubToken, causing credentials supplied through GH_TOKEN, GITHUB_TOKEN, ZIZMOR_GITHUB_TOKEN, --gh-token, --github-token, or --zizmor-github-token to be written to stderr in cleartext. A single -v or --verbose option or an applicable RUST_LOG directive enables the affected logging during normal online operation and --no-online-audits, while explicit --offline clears the token first. If another party can read a CI log, support artifact, terminal capture, or public bug report containing the output, the party can use the credential according to its scopes, repository access, and lifetime. This vulnerability is fixed in 1.28.0.

CVSS 4.0 · 7 High EPSS < 1% KEV · Not listed

Vendors

Zizmorcore

Products

Zizmor

CVE-2026-117477

HTTP Header Injection via Crafted URLs

KUSANAGI provided by GMO Prime Strategy Co., Ltd. contains an HTTP header injection vulnerability that may allow arbitrary HTTP headers to be injected into the HTTP response when a user accesses a specially crafted URL.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Gmo Prime Strategy

Products

Kusanagi

CVE-2026-125358

Universal-modder before e88f687 Cross-Site WebSocket Command Execution via HostLink

Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any web page open in the player's browser can connect cross-site to the unauthenticated loopback WebSocket and send cmd messages that WorldBridge.command() runs with operator authority.

CVSS 4.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Rehan-remade

Products

Universal-modder

CVE-2026-125365

DollarDollar through 4.4 Missing Authorization in /add_expense Balance Tampering

DollarDollar through 4.4 contains a missing authorization vulnerability in add_expense() that allows authenticated users to modify other users' account balances by supplying foreign account_id values. Attackers can submit sequential account_id, destination_account_id, and group_id values to /add_expense to tamper with balances and inject expenses into foreign groups with an arbitrary payer.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Harung1993

Products

Dollardollar

CVE-2026-125366

Omnom through 0.9.0 SSRF via Add Feed /add_feed Route

Omnom through 0.9.0 contains a server-side request forgery vulnerability that allows authenticated users to make server requests to arbitrary hosts by submitting feed URLs to /add_feed. Attackers can supply internal addresses that getFeedInfo, gofeed ParseURL, and fetchImageAsInlineURL fetch without validation, using reflected error messages to probe internal hosts and ports.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Asciimoo

Products

Omnom

CVE-2026-125369

Bitpoll through 0.11.0 Unauthenticated Vote and Comment Disclosure via Unscoped Lookups

Bitpoll through 0.11.0 contains an insecure direct object reference vulnerability that allows unauthenticated attackers to read votes and comments from other polls via unscoped object lookups in views.py. Attackers can pair any public poll slug with sequential vote or comment IDs in vote, vote_delete, vote_assign, or delete_comment GET requests to read names and comments from restricted polls.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Fsinfuhh

Products

Bitpoll

CVE-2026-125373

IETF Datatracker before 12.83.0 Cross-NomCom Authorization Bypass via Nomcom Views

IETF Datatracker before 12.83.0 contains an authorization bypass vulnerability that allows NomCom role holders to access other committees' records by supplying sequential primary keys. Attackers can abuse view_feedback_nominee, view_feedback_topic, view_feedback_unrelated and edit_nominee to view confidential nominee identities, reclassify feedback, and change nominee email addresses.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Ietf-tools

Products

Datatracker

CVE-2026-125381

DataRoom through 3.0.0 SQL Injection via MyBatisService.generateSql

DataRoom through 3.0.0 contains an sql injection vulnerability in MyBatisService.generateSql that allows sharer-role users to inject SQL by supplying crafted dataset parameters. Attackers can send crafted inputParam values to /dataRoom/dataset/run, exploiting unquoted string parameters or MySQL backslash escapes, to execute injected SQL against the database.

CVSS 4.0 · 6 Medium EPSS < 1% KEV · Not listed

Vendors

Gcpaas

Products

Dataroom

CVE-2026-125382

Map-OS 5.0.0 to before 5.2.2 Privilege Escalation via /api/v1/usuarios

Map-OS 5.0.0 to before 5.2.2 contains a privilege escalation vulnerability in the REST users API that allows non-administrator operators holding the cUsuario permission to bypass permission-delegation and super-administrator protections. Attackers can send POST, PUT, or DELETE requests to /api/v1/usuarios to assign the Administrador group, reset the super administrator password, or delete higher-privileged users.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Mapos Ramonsilva20

Products

Map-os Mapos

CVE-2026-89115

Information Disclosure vulnerability in SAP Start Service and SAP Microsoft Management Console

SAP Start Service and SAP Management Console store sensitive credential information in process memory without protection. An attacker with high privileges and local access could inspect the memory to recover credentials and reuse them for authentication. This results in a high impact on confidentiality and no impact on integrity and availability.

CVSS 3.1 · 4.4 Medium EPSS < 1% KEV · Not listed

Vendors

Sap

Products

Sap Start Service And Sap Microsoft Management Console

CVE-2026-107243

Legacy Hard-Coded Session Secret in VOS Node.js Web Service Enables Cookie Forgery

The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The express-session middleware in server.js is configured with a hardcoded secret that is identical across all VOS appliances and is used to sign session cookies. An attacker who obtains a valid session ID from any source can compute the correct HMAC-SHA256 signature and forge a session cookie that the server accepts as legitimate. Because the secret is shared across all VOS appliances, a forged cookie is accepted by any VOS appliance in the deployment.  Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.

CVSS 3.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Versa

Products

Vos

CVE-2026-107241

Node.js Web Service Default Credentials Expose URL-based Provisioning on Versa VOS

The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. This service authenticates users and administrators to its web interface during initial provisioning using default credentials and HTTP Basic Authentication. An attacker with network access who knows the default credentials could authenticate to the service and perform provisioning actions on the VOS appliance.  Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.

CVSS 3.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Versa

Products

Vos

CVE-2026-107240

Unauthorized Shell Execution via Newline Injection in VOS Node.js Authentication Endpoint

The Node.js web service on VOS (previously Versa FlexVNF) is used for URL-based Zero Touch Provisioning (ZTP) of the VOS appliance and is not required after provisioning is complete. The /authenticate endpoint of this service passes user-supplied username and password values to child_process.exec() through a sanitizer (escapeRegExp) that removes regular expression metacharacters but not newline characters. An unauthenticated attacker can inject a newline character into the username field to execute arbitrary shell commands as the versa OS service user. No credentials are required; the attacker needs only a CSRF token, which can be obtained from an unauthenticated page load.  Versa’s security hardening guide for Hubs, Branches, and Controllers recommends disabling the Node.js web service after the initial provisioning of the VOS device. This vulnerability is not exploitable on VOS devices where the Node.js web service has been disabled.

CVSS 3.0 · 7.6 High EPSS < 1% KEV · Not listed

Vendors

Versa

Products

Vos

CVE-2026-50240

Pipelines-as-code: openshift-pipelines-operator-rh: pipelines-as-code: repository users can trigger namespace edit-equivalent execution via auto-provisioned pipeline serviceaccount

A flaw was found in OpenShift Pipelines-as-Code (PAC). PAC does not verify whether the creator of a Repository custom resource has permission to create PipelineRuns. A namespace user with only Repository and Secret create/delete permissions can cause PAC to execute attacker-controlled PipelineRuns as the auto-provisioned pipeline ServiceAccount, which carries ClusterRole/edit by default. This results in namespace-scoped privilege escalation, enabling Secret read, resource creation/modification/deletion, and potential supply chain injection in CI/CD namespaces.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Openshift Builds Openshift Devspaces Openshift Pipelines and 2 more

CVE-2026-69150

KeePassXC: Heap use-after-free in KeePass1 (KDB) importer via unpruned m_entryUuids map

KeePassXC is a cross-platform community-driven port of the Windows application KeePass Password Safe. Prior to 2.8.0-beta1, KeePass1 / KDB legacy import retains raw Entry pointers in m_entryUuids after deleting metastream entries. When a crafted, unlockable .kdb file contains an earlier metastream entry followed by a KPX_CUSTOM_ICONS_4 metastream that references the earlier UUID, parseCustomIcons4() calls Entry::setIcon through the stale pointer, causing a heap use-after-free with a controlled write and a reliable process crash. This issue is fixed in version 2.8.0-beta1.

CVSS 4.0 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Keepassxc

Products

Keepassxc

CVE-2026-49265

OAuthLib: Timing Attack Vulnerability in PKCE code_verifier Comparison

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 3.0.0 until 4.0.0, OAuthLib's PKCE checks in oauthlib/oauth2/rfc6749/grant_types/authorization_code.py compare attacker-supplied code_verifier values with stored challenges using ordinary string equality in code_challenge_method_plain and code_challenge_method_s256. Because the comparison can return after a length difference or the first mismatching character, repeated token endpoint measurements can reveal common-prefix timing information that could potentially allow recovery of the code_verifier, unauthorized access-token acquisition, and account takeover. Practical exploitation requires an intercepted, single-use authorization code and enough measurements to overcome real-world network noise; the local timing benchmark does not establish practical remote account takeover, so the weakness remains a defense-in-depth concern. This issue is fixed in version 4.0.0.

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Oauthlib

Products

Oauthlib

CVE-2026-49264

OAuthLib: Unsafe JSONP callback injection in RevocationEndpoint allows arbitrary JavaScript response generation

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. From 0.6.1 until 4.0.0, OAuthLib's RevocationEndpoint in oauthlib/oauth2/rfc6749/endpoints/revocation.py reflects an unvalidated callback request parameter into success and error response bodies when enable_jsonp=True. The callback can come from the query string or request body and is used without restricting it to a legal JavaScript function name. A browser application that loads the revocation response as trusted JSONP and permits attacker influence over callback can therefore execute attacker-controlled JavaScript in the including application's origin, with access to its DOM and script-accessible data. The feature is disabled by default, so only deployments that explicitly enable JSONP are affected. This issue is fixed in version 4.0.0.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Oauthlib

Products

Oauthlib

CVE-2026-110129

fuintCatering through commit 122c9e6 IDOR via /clientApi/refund/detail

fuintCatering through commit 122c9e6 contains an insecure direct object reference vulnerability in the ClientRefundController refund detail endpoint that lets authenticated members read other members' refund records. Attackers can register freely and enumerate sequential refundId values to obtain buyers' names, national ID numbers, addresses, WeChat openIds, and order details.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Fushengqian

Products

Fuintcatering

CVE-2026-93294

Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs

A user with query access to an Azure Monitor data source can use its resource proxy to call Azure Resource Manager APIs beyond those Grafana needs, with the data source's Azure identity (unintended proxy). The impact is bounded by the Azure role granted to that identity.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Grafana

Products

Grafana Grafana Enterprise

CVE-2026-15577

Git Sync connection configuration can be modified with read-only access

A user or service account with read-only access to Git Sync (provisioning) connections can modify a connection's configuration through its status subresource (incorrect authorization). On Grafana 12.4 the affected API is only available when the experimental provisioning feature toggle is enabled.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Grafana

Products

Grafana Grafana Enterprise