CVE Notifier

CVE-2026-61534 CWE-1321 9.1

Yayson: Prototype pollution in the Store/LegacyStore deserialization

Yayson is a library for serializing and reading JSON API data in JavaScript. Prior to 4.3.0, Store and LegacyStore use attacker-controlled JSON:API type, id, and relationship names as keys in plain-object lookup tables i…

cve.org confetti:yayson 14 Sep 2026

CVE-2026-47701 CWE-200 7.7

OpenTelemetry Operator: ServiceMonitor bearerTokenFile reads arbitrary local file and sends contents as bearer auth

The OpenTelemetry Operator is a Kubernetes Operator for the OpenTelemetry Collector. Prior to 0.152.0, cmd/otel-allocator TargetAllocator instances with targetAllocator.prometheusCR.enabled set to true preserve a selecte…

cve.org open-telemetry:opentelemetry-operator 14 Sep 2026

CVE-2026-88819 CWE-290 N/A

CVE-2026-88819

In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID.

cve.org Eclipse · Foundation:Eclipse · Data 14 Sep 2026

CVE-2026-54541 CWE-248 3.7

Nimiq: Panic in TrieProof::verify via child_index unwrap on equal-length keys

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk proof co…

cve.org nimiq:core-rs-albatross 14 Sep 2026

CVE-2026-90794 CWE-416 6.3

GPAC MP4Box vrml_tools.c gf_sg_script_load use after free

A vulnerability was found in GPAC up to f1219cde. The affected element is the function gf_sg_script_load of the file scenegraph/vrml_tools.c of the component MP4Box. Performing a manipulation results in use after free. I…

cve.org n/a:GPAC 14 Sep 2026

CVE-2026-54542 CWE-125 3.7

Nimiq: Out-of-bounds panic in KeyNibbles::Add from oversized child suffix in a deserialized proof

Nimiq is a Rust implementation of the Nimiq Proof-of-Stake protocol based on the Albatross consensus algorithm. Prior to 1.6.0, a malicious state-sync peer can crash a syncing node by sending a crafted TrieChunk whose pr…

cve.org nimiq:core-rs-albatross 14 Sep 2026

CVE-2025-24890 CWE-283 6.8

gix-sec safe.directory protections absent for elevated administrators

gitoxide is an implementation of git written in Rust. Prior to 0.13.3, the gix-sec crate on Windows incorrectly treats repositories controlled by another user as trusted when an administrator runs a dependent program wit…

cve.org GitoxideLabs:gitoxide 14 Sep 2026

CVE-2026-90463 CWE-125 4.0

Sssd: local oob read in nss service request parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`)

A flaw was found in the sssd NSS responder. This input validation vulnerability allows a local attacker, by sending specially crafted service lookup requests to the NSS responder's UNIX socket, to cause an out-of-bounds …

cve.org Red · Hat:Red · Hat 14 Sep 2026

CVE-2026-90947 CWE-787 7.8

Gimp: gimp: out-of-bounds write in lighting effects plugin via crafted preset file

A flaw was found in GIMP. When processing a specially crafted lighting preset file, the Lighting Effects filter does not properly validate the number of light sources. This can lead to an out-of-bounds write, corrupting …

cve.org Red · Hat:Red · Hat 14 Sep 2026

CVE-2026-90793 CWE-416 5.4

GPAC MP4Box base_scenegraph.c gf_node_get_name use after free

A vulnerability has been found in GPAC up to f1219cde. Impacted is the function gf_node_get_name of the file scenegraph/base_scenegraph.c of the component MP4Box. Such manipulation leads to use after free. The attack may…

cve.org n/a:GPAC 14 Sep 2026

CVE-2026-57145 CWE-22 9.1

PraisonAI: Arbitrary File Read/Write via `multiedit` Tool Without Path Validation

PraisonAI is a multi-agent teams system. Prior to 4.6.62, src/praisonai/praisonai/tools/multiedit.py passes the LLM-controlled filepath parameter directly to open for reading and writing without traversal rejection, syml…

cve.org MervinPraison:PraisonAI 14 Sep 2026

CVE-2026-57132 CWE-287 8.2

PraisonAI: PRAISONAI_CALL_AUTH=disabled environment variable unconditionally disables authentication

PraisonAI is a multi-agent teams system. Prior to 4.6.62, setting PRAISONAI_CALL_AUTH to disabled makes verify_token accept requests to /api/v1/agents/{id}/invoke without CALL_SERVER_TOKEN authentication. Deployments tha…

cve.org MervinPraison:PraisonAI 14 Sep 2026