CVE Notifier

CVE-2026-54167 CWE-345 8.2

Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, the GitHub App provider accepts X-GitHub-Enterprise-Host as the API ho…

cve.org tektoncd:pipelines-as-code 15 Sep 2026

CVE-2026-54168 CWE-269 6.5

Pipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution

Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub App installation token created during webhook processing is n…

cve.org tektoncd:pipelines-as-code 15 Sep 2026

CVE-2026-90439 CWE-122 6.5

NGINX ngx_http_v3_module vulnerability

NGINX Plus and NGINX Open Source have a vulnerability in the ngx_http_v3_module module. When using HTTP/3 with OpenSSL versions <= OpenSSL 3.5.0 under certain configurations, a limited heap buffer overflow could happen w…

cve.org F5:NGINX · Plus · F5:NGINX 15 Sep 2026

CVE-2026-39919 CWE-122 9.8

Ghostscript < 10.08.0 Heap Buffer Overflow via JPEG 2000 Output Adapter

Ghostscript before 10.08.0 contains a heap-based buffer overflow vulnerability in the JPEG 2000 output adapter (base/sjpx_openjpeg.c) that allows attackers to cause memory corruption by supplying a crafted PDF containing…

cve.org Artifex · Software:Ghostscript 15 Sep 2026

CVE-2026-57586 CWE-78 8.6

CodeRAG: Gradle Wrapper Execution During Dependency Discovery Enables Arbitrary Code Execution

CodeRAG is a lightweight semantic code search and distillation utility for AI coding agents. Prior to 1.3.1, the default agent-coderag sync flow in code_rag/entry/cli.py calls sync_dependencies for an indexed path, and c…

cve.org naranor:agent-coderag 15 Sep 2026

CVE-2026-91835 CWE-436 2.8

OpenClaw ClawScan File Classifier static_scanner.go IsBinaryFile interpretation conflict

A vulnerability was detected in OpenClaw ClawScan up to 0.1.6. The impacted element is the function IsBinaryFile of the file internal/runner/static_scanner.go of the component File Classifier. The manipulation results in…

cve.org OpenClaw:ClawScan 15 Sep 2026

CVE-2026-89025 CWE-755 7.5

Hirschmann HiOS Switch Platform DoS via Malformed HTTP Request

Hirschmann HiOS Switch Platform devices contain a denial-of-service vulnerability in the integrated web server due to missing validation of HTTP(S) content. A remote unauthenticated attacker can send a specially crafted …

cve.org Belden:Hirschmann · HiOS · Switch 15 Sep 2026

CVE-2026-59971 CWE-306 10.0

MySQL MCP Server: Missing Origin/Host Validation in SSE Transport Enables Unauthenticated SQL Execution (DNS Rebinding / Direct Exposure)

MySQL MCP Server is a Model Context Protocol server that enables secure interaction with MySQL databases. Prior to 0.4.2, setting MCP_TRANSPORT=sse causes src/mysql_mcp_server/server.py to construct SseServerTransport wi…

cve.org designcomputer:mysql_mcp_server 15 Sep 2026

CVE-2026-46495 CWE-502 N/A

OpenDJ Pre-Auth RCE via Java Deserialization in JMX RMI

OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.1, the JMX RMI connector in opendj-server-legacy/src/main/java/org/opends/server/protocols/jmx/RmiConnector.java processes attacker-controlled credential obje…

cve.org OpenIdentityPlatform:OpenDJ · org.openidentityplatform.opendj:opendj-server-legacy 15 Sep 2026

CVE-2026-48722 CWE-276 5.5

Nextflow: Incorrect default permissions in the nextflow auth login command

Nextflow is a DSL for data-driven computational pipelines. From 25.09.2-edge until 25.10.6 and 26.04.3, nextflow auth login writes Seqera Platform OIDC bearer tokens to ${NXF_HOME:-~/.nextflow}/seqera-auth.config through…

cve.org nextflow-io:nextflow 15 Sep 2026

CVE-2026-49254 CWE-200 N/A

Dragonfly Manager OAuth provider client_secret disclosure via unauthenticated GET /api/v1/oauth

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4, manager/router/router.go registers GET /api/v1/oauth and GET /api/v1/oauth/:id without jwt.MiddlewareFunc() or RBAC()…

cve.org dragonflyoss:dragonfly 15 Sep 2026

CVE-2026-54637 CWE-918 N/A

Dragonfly scheduler v1 gRPC unauthenticated SSRF via attacker-controlled PeerHost in DownloadTinyFile

Dragonfly is an open source P2P-based file distribution and image acceleration system. Prior to 2.4.4-rc.3, the scheduler's default unauthenticated v1 gRPC flow accepts attacker-controlled PeerHost.Ip and PeerHost.DownPo…

cve.org dragonflyoss:dragonfly 15 Sep 2026