CVE-2026-46377

Dasel: Index-out-of-range panic in dasel selector lexer on trailing backslash in quoted string

Dasel is a command-line tool and library for querying, modifying, and transforming data structures. From 3.0.0 until 3.10.1, the escape sequence handler in (*Tokenizer).parseCurRune in selector/lexer/tokenize.go increments past a trailing backslash in a quoted string such as "\ or '\ and then reads p.src[pos] without a bounds check, allowing attacker-controlled selector strings to trigger a Go index-out-of-range panic. This issue is fixed in version 3.10.1.

CVSS 3.1 · 6.2 Medium EPSS < 1% KEV · Not listed

Vendors

Tomwright

Products

Dasel

CVE-2026-47081

cyrus-imapd: Cyrus IMAP: Information disclosure of mailbox existence via XAPPLEPUSHSERVICE command

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. There is an XAPPLEPUSHSERVICE folder existence oracle and push hijack. An authenticated IMAP user could probe for the existence of arbitrary mailboxes on other users' accounts via the XAPPLEPUSHSERVICE command and then create Apple Push Notification Service notifications for new mail in those mailboxes to their own APNS device. This did not leak any data about the content of mailboxes. Instead, a "mailbox has changed" notice would be pushed when the mailbox modseq changed.

CVSS 3.1 · 3.1 Low EPSS < 1% KEV · Not listed

Vendors

Cyrusimap

Products

Cyrus Imap

CVE-2026-47084

cyrus-imapd: Cyrus IMAP: Unauthorized mailbox deletion via ACL bypass

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. The LOCALDELETE command bypassed ACL checks. An authenticated but non-admin user could invoke the admin-only LOCALDELETE IMAP command and delete mailboxes for which they had no permissions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Cyrusimap

Products

Cyrus Imap

CVE-2026-47085

cyrus-imapd: Cyrus IMAP: Information disclosure via URLAUTH token forgery

An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. URLAUTH token forgery can occur via a missing mboxkey. If an attacker knew a folder name on the victim's account for which the victim had never issued an auth URL, they could forge a working URLAUTH token by computing an HMAC-SHA1 value with a predictable key, giving them read access to the mailbox. (URLAUTH is an obscure feature, meaning that the odds of any user actually being susceptible to this attack are very low. Perhaps no public clients use URLAUTH.)

CVSS 3.1 · 4 Medium EPSS < 1% KEV · Not listed

Vendors

Cyrusimap

Products

Cyrus Imap

CVE-2026-46353

BigBlueButton API checksum bypass via presentationUploadExternalUrl

BigBlueButton is an open-source virtual classroom. Prior to 3.0.21, bbb-web checksum validation could be bypassed when a presentationUploadExternalUrl parameter was supplied to API request handling in CreateMeeting.java and ValidationService.java, allowing a user to send valid requests to some endpoints without a checksum. This issue is fixed in version 3.0.21.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Bigbluebutton

Products

Bigbluebutton

CVE-2026-45737

Argo CD: Kubernetes Secret Extraction via ArgoCD ServerSideDiff via sensitive annotations

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3.3.10, and 3.4.2, Argo CD ServerSideDiff can expose Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configuration annotation because HideSecretData(target, live, ...) does not fully sanitize ResourceDiff.TargetState and LiveState predicted live Secret objects, allowing sensitive data, stringData, and annotations to appear in UI or CLI diffs. This issue is fixed in versions 3.2.12, 3.3.10, and 3.4.2.

CVSS 3.1 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Argoproj

Products

Argo-cd Argo Cd

CVE-2026-62348

TDengine: KILL SSMIGRATE missing authorization lets low-privilege users interrupt shared-storage migrations

TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, TDengine Enterprise allowed an authenticated low-privilege SQL user to run KILL SSMIGRATE <id> against an active shared-storage migration because mndProcessKillSsMigrateReq called mndKillSsMigrate while the intended MND_OPER_SSMIGRATE_DB privilege check was commented out. This issue is fixed in version 3.4.1.15.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Taosdata

Products

Tdengine

CVE-2026-45576

zrok copy writes attacker-controlled WebDAV paths outside the destination root

zrok is software for sharing web services, files, and network resources. From 0.4.23 until 2.0.3, `zrok2 copy` stores attacker-controlled WebDAV or zrok drive paths such as /../outside.txt in the source inventory and passes them to FilesystemTarget.WriteStream, allowing the sync pipeline to write files outside the selected local filesystem destination root. This issue is fixed in version 2.0.3.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Netfoundry Openziti

Products

Zrok Zrok

CVE-2026-49352

9Router: Hardcoded Default fallback JWT Secret Allows Authentication Bypass

9Router is an AI router & token saver. From 0.2.21 until 0.4.44, 9Router used the hardcoded fallback JWT secret 9router-default-secret-change-me in src/app/api/auth/login/route.js, src/middleware.js, and later src/lib/auth/dashboardSession.js, allowing attackers to forge an auth_token cookie when JWT_SECRET was unset. This issue is fixed in version 0.4.44

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Decolua

Products

9router

CVE-2026-62312

9Router: Authenticated RCE via Unvalidated MCP Plugin Arguments

9Router is an AI router & token saver. Prior to 0.5.2, 9Router allows a remote authenticated attacker to achieve arbitrary code execution on the host operating system by combining a Host header bypass of localhost-only routes with unvalidated MCP plugin args passed to child_process.spawn(), allowing malicious custom plugins to execute commands through /api/mcp//sse. This issue is fixed in version 0.5.2.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Decolua

Products

9router

CVE-2026-48795

Incomplete fix for CVE-2026-25754 in @adonisjs/bodyparser

AdonisJS is a TypeScript-first web framework. From 10.1.3 until 10.1.5 and 11.0.3, AdonisJS @adonisjs/bodyparser incompletely fixed CVE-2026-25754 because nested multipart field payloads such as user.__proto__.polluted and constructor.prototype still caused lodash _.set() via @poppinss/utils to create plain intermediate objects and pollute Object.prototype. This issue is fixed in versions 10.1.5 and 11.0.3.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Adonisjs

Products

Core

CVE-2026-53447

Wekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) any private board by ID

Wekan is open source kanban built with Meteor. Prior to 9.35, the Wekan cloneBoard Meteor method in models/import.js uses caller-supplied sourceBoardId to build a board export through models/exporter.js without invoking canExport() or checking source-board membership. Any authenticated user who knows a private board ID can clone the board into their own account and read its cards, comments, attachments, member information, and activities. This issue is fixed in version 9.35.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Wekan

Products

Wekan

CVE-2026-46686

Emlog Reflected Cross-Site Scripting

Emlog is an open source website building system. In 2.6.13 and earlier, the admin backend user search module's keyword parameter from admin/user.php is processed with addslashes but not HTML-escaped before being rendered into the value attribute in admin/views/user.php, allowing reflected cross-site scripting in an administrator's backend session. No fixed version is currently identified.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Emlog

Products

Emlog

CVE-2026-46687

Emlog Local File Inclusion (LFI)

Emlog is an open source website building system. In 2.6.13 and earlier, the article publishing interface stores a path-traversal template parameter from api_controller.php without validation, and log_controller.php later checks file_exists and calls include View::getView($template), allowing an authenticated author to include an arbitrary local .php file when an article is viewed. No fixed version is currently identified.

CVSS 4.0 · 7.7 High EPSS < 1% KEV · Not listed

Vendors

Emlog

Products

Emlog

CVE-2026-14461

Out-of-bound read in mtr

mtr is vulnerable to Out-of-bound read vulnerability in ipinfo_lookup() function. An attacker who can influence the TXT response used for AS lookups can trigger this bug by returning a DNS response that is larger than 512 bytes and uses a crafted compression pointer in the answer NAME field. ipinfo_lookup() function uses the length of the response as the end-of-message boundary for dn_expand() function. The result is a reliable crash. This issue exists in the mtr through version 0.96 and it was fixed in commit 48e1794414d338ce47abc0f27c25ade8788af9c3.

CVSS 4.0 · 5.1 Medium EPSS < 1% KEV · Not listed

Vendors

Bitwizard

Products

Mtr

CVE-2026-38974

dulwich: Dulwich: Missing SSH host key verification allows potential impersonation

Dulwich through 1.1.0 was found to be missing SSH host key verification in contrib/paramiko_vendor.py.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Jelmer

Products

Dulwich

CVE-2026-14890

CVE-2026-14890

SGLang uses an expert-parallel backup subsystem that exposes a ZeroMQ PULL socket on a routable network interface that does not contain authentication or deserialization safeguards, allowing an attacker to provide a malicious pickle file that results in unauthenticated remote code execution when the feature is enabled and the service is reachable over the network.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Lmsys Sglang

Products

Sglang Sglang

CVE-2026-33382

Denial of service via unbounded request body size

Several Grafana API endpoints, some of them unauthenticated, do not limit the size of the request body before processing it. An attacker can send very large payloads that force excessive memory allocation, potentially exhausting memory and causing a denial of service.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed

Vendors

Grafana

Products

Grafana

CVE-2026-8609

Pre-authentication denial of service via the OAuth login route

An unauthenticated attacker can repeatedly call Grafana's OAuth login route with unique values, causing unbounded memory growth that can eventually exhaust memory and crash the Grafana instance (denial of service).

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Grafana

Products

Grafana

CVE-2026-55548

Yamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsApi.java failed to enforce object-level ReadPacket privileges when a request omitted specific packet names: with an empty name list the ctx.checkObjectPrivileges(ObjectPrivilegeType.ReadPacket, nameSet) call passed over an empty set, no WHERE pname IN filter was applied to the resulting SELECT * FROM tm query, and the onTuple handler streamed every retrieved packet without any per-row authorization check, so a low-privileged or zero-privilege authenticated user could dump the entire raw telemetry packet archive and bypass the role-based access control model. This issue is fixed in versions 5.12.8 and 5.13.2, which enforce per-packet ReadPacket checks in exportPackets.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Spaceapplications Yamcs

Products

Yamcs Yamcs