CVE Notifier

CVE-2026-91021 CWE-? N/A

CVE-2026-91021

Trilium Notes, version v0.103.0 and earlier, contains a stored cross-site scripting (XSS) vulnerability in the share renderer for webView notes due to improper HTML escaping of user-controlled #webViewSrc values. This vu…

cve.org Trilium:Trillium · Notes 14 Sep 2026

CVE-2026-54087 CWE-79 7.6

EasyAdmin: Stored Cross-Site Scripting (XSS) via uploaded files served inline in FileField and ImageField

EasyAdmin is a fast and modern admin generator for Symfony applications. From 5.0.0 until 5.0.13, FileField and ImageField can accept browser-executable uploads while templates/crud/field/file.html.twig links to stored f…

cve.org EasyCorp:EasyAdminBundle 14 Sep 2026

CVE-2026-34151 CWE-24 N/A

XWiki Platform: Resource path traversal via /skin/ action endpoint in Jetty 12+

XWiki Platform is a generic wiki platform. Prior to 17.10.5 and 18.2.0, the /skin/ action in com.xpn.xwiki.web.SkinAction can resolve double-encoded parent-directory segments outside the intended skin or web-application …

cve.org xwiki:xwiki-platform 14 Sep 2026

CVE-2026-19499 CWE-122 7.7

Buffer overflow in strfmon and strfmon_l right-justification padding

Calling strfmon and strfmon_l in the GNU C Library version 2.38 to 2.44 can write past the end of the caller-supplied output buffer when a conversion uses right-justified width padding. Exploitation requires an applicat…

cve.org The · GNU · C 14 Sep 2026

CVE-2026-55253 CWE-943 7.7

LangChain MongoDB: NoSQL Operator Injection in MongoDBSaver.list() leading to cross-tenant data exposure

LangChain MongoDB provides integrations between MongoDB, Atlas, LangChain, and LangGraph. Prior to langgraph-checkpoint-mongodb 0.3.0 and langgraph-store-mongodb 0.4.0, MongoDBSaver.list(), MongoDBSaver.alist(), and Mong…

cve.org langchain-ai:langchain-mongodb · langchain-ai:langgraph-checkpoint-mongodb · langchain-ai:langgraph-store-mongodb 14 Sep 2026

CVE-2026-46696 CWE-269 3.3

October CMS: Safe Mode Sandbox Bypass via Session Store and Forwarded Builder Calls

October System provides the system module for October Content Management System. Versions prior to 3.7.17 and 4.2.21 have a vulnerability in the Twig sandbox security policy that allowed a chained bypass when `cms.safe_m…

cve.org octobercms:system 14 Sep 2026

CVE-2026-50157 CWE-598 6.5

Auth0 Symfony: Bearer Token Accepted via URL Query Parameter in Auth0 Symfony SDK

Auth0 Symfony is a Symfony SDK for Auth0 Authentication and Management APIs. From 5.0.0-BETA0 until 5.9.0, the Authorizer::authenticate() and Authorizer::supports() paths in the Authorizer security authenticator may acce…

cve.org auth0:symfony 14 Sep 2026

CVE-2026-50276 CWE-770 7.5

dd-trace-rb: Improper parsing of W3C baggage headers may lead to DoS

dd-trace-rb is Datadog's client library for Ruby. Prior to 2.32.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64, or DD_TRACE_BAGGAGE_MAX_BYTES, which defaults to 8192, although…

cve.org DataDog:dd-trace-rb 14 Sep 2026

CVE-2026-50270 CWE-770 7.5

dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS

dd-trace-java is a Datadog APM client for Java. Prior to 1.62.0, W3C baggage extraction does not enforce DD_TRACE_BAGGAGE_MAX_ITEMS, which defaults to 64, or DD_TRACE_BAGGAGE_MAX_BYTES, which defaults to 8192, although t…

cve.org DataDog:dd-trace-java · com.datadoghq:dd-java-agent 14 Sep 2026

CVE-2026-90804 CWE-120 4.8

GNU Binutils Eh Frame Section elf-eh-frame.c _bfd_elf_write_section_eh_frame buffer overflow

A vulnerability was detected in GNU Binutils 2.47. Affected by this issue is the function _bfd_elf_write_section_eh_frame of the file bfd/elf-eh-frame.c of the component Eh Frame Section Handler. Performing a manipulatio…

cve.org GNU:Binutils 14 Sep 2026

CVE-2026-59960 CWE-78 7.5

Argos JavaScript: CI Branch Name OS Command Injection in @argos-ci/core

Argos JavaScript provides official Argos SDKs for JavaScript. Prior to Argos core package version 6.2.1, attacker-controlled CI branch or ref values from GITHUB_HEAD_REF or ARGOS_BRANCH can flow through config.branch and…

cve.org argos-ci:argos-javascript 14 Sep 2026

CVE-2026-55102 CWE-209 N/A

hashi-vault-js: Vault token and secret values exposed in thrown errors

hashi-vault-js is a Node.js module for interacting with the HashiCorp Vault API. Prior to 0.5.2, every API method in src/Vault.js passes failed requests through parseAxiosError(), which rethrows the raw AxiosError while …

cve.org kyndryl-open-source:hashi-vault-js 14 Sep 2026