CVE Notifier

CVE-2026-65838 CWE-754 8.2

Skipper: an oversized declared-`Content-Length` body still hands OPA an empty `parsed_body`, so deny-on-presence Rego policies fail OPEN while the full payload reaches upstream

Skipper is an HTTP router and reverse proxy for service composition. Prior to 0.27.35, the opaAuthorizeRequestWithBody filter in filters/openpolicyagent/openpolicyagent.go can allow an oversized declared Content-Length r…

cve.org zalando:skipper 14 Sep 2026

CVE-2026-55244 CWE-248 5.0

ASTEVAL: Sandbox Escape via BaseException Subclasses

ASTEVAL is an evaluator of Python expressions and statements. Prior to 1.0.9, FROM_PY in asteval/astutils.py exposes BaseException, SystemExit, KeyboardInterrupt, and GeneratorExit to expressions evaluated by asteval.Int…

cve.org lmfit:asteval 14 Sep 2026

CVE-2026-90816 CWE-404 4.3

FFmpeg Duration hlsproto.c parse_playlist denial of service

A vulnerability was found in FFmpeg 8.0.x. This affects the function parse_playlist of the file libavformat/hlsproto.c of the component Duration Parser. Performing a manipulation of the argument duration/target_duration …

cve.org n/a:FFmpeg 14 Sep 2026

CVE-2026-15887 CWE-918 5.4

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 is affected by blind server-side request forgery when processing SOAP requests.

cve.org IBM:WebSphere · Application · Server 14 Sep 2026

CVE-2026-54632 CWE-20 7.5

SIPSorcery: Malformed UDP packet on the RTP/ICE socket can remotely terminate a media session (DoS)

SIPSorcery is a WebRTC, SIP, and VoIP library for C# and .NET. Prior to 10.0.9, RTPChannel.OnRTPPacketReceived and the STUNAttribute.ParseMessageAttributes, STUNXORAddressAttribute, and STUNAddressAttribute parsing path …

cve.org sipsorcery-org:sipsorcery 14 Sep 2026

CVE-2026-15955 CWE-22 7.5

IBM® Data Server driver for JDBC and SQLJ could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 could allow a remote attacker to perform an arbitrary file write due to improper validation of file paths.

cve.org IBM:Db2 14 Sep 2026

CVE-2026-16186 CWE-79 5.4

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 is affected by a reflected cross-site scripting vulnerability.

cve.org IBM:WebSphere · Application · Server 14 Sep 2026

CVE-2026-54628 CWE-284 8.6

Anyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes URL-capable SQLite virtual table modules such as json_reader and log_reader through its unauthenticated MySQL-compatible ser…

cve.org julien040:anyquery 14 Sep 2026

CVE-2026-16185 CWE-862 6.4

IBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities

IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication on an admin console servlet.

cve.org IBM:WebSphere · Application · Server 14 Sep 2026

CVE-2026-82028 CWE-89 8.8

Magistrala < 1.0.0 SQL Injection via format Parameter in Reader API

Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a malicious format que…

cve.org absmach:magistrala 14 Sep 2026

CVE-2026-50006 CWE-22 9.1

Anyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to SQLite without restricting ATTACH DATABASE filesystem targets.…

cve.org julien040:anyquery 14 Sep 2026

CVE-2026-54629 CWE-22 7.5

Anyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode

Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csv_reader and log_reader through its MySQL-compatible server port without …

cve.org julien040:anyquery 14 Sep 2026