CVE Notifier

CVE-2026-90784 CWE-401 5.3

Dvidelabs flatcc semantics.c fb_clear_parser memory leak

A vulnerability has been found in Dvidelabs flatcc up to 0.6.3. The impacted element is the function fb_clear_parser of the file src/Compiler/semantics.c. The manipulation leads to memory leak. It is possible to initiate…

cve.org Dvidelabs:flatcc 14 Sep 2026

CVE-2026-78299 CWE-22 N/A

CVE-2026-78299

In Eclipse Embedded CDT versions 6.0 to 6.7 if the CMSIS-Pack archive extracts a compromised CMSIS pack the archive extraction can extract files to locations outside of the pack, allowing writing of arbitrary files to ot…

cve.org Eclipse · Foundation:Eclipse · Embedded 14 Sep 2026

CVE-2026-73470 CWE-269 N/A

Apache Syncope: Delegating users can grant unowned Roles

Improper Privilege Management vulnerability in Apache Syncope. Delegations can be created or updated with Roles not owned by the delegating User, or not for the same Realm subtree under the delegation management was…

cve.org Apache · Software · Foundation:Apache 14 Sep 2026

CVE-2026-73579 CWE-863 N/A

Apache Syncope: Non-recursive Any search could skip Realms restrictions

Incorrect Authorization vulnerability in Apache Syncope. Any search requests are transformed into SQL, Neo4J or Elasticsearch / Opensearch queries, depending on the actual deployment configuration. An important compon…

cve.org Apache · Software · Foundation:Apache 14 Sep 2026

CVE-2026-75015 CWE-522 N/A

Apache Syncope: Nested secrets leak cleartext into audit records readable

Insufficiently Protected Credentials vulnerability in Apache Syncope. Audit events, when sent to the configured store, are not sufficiently masked for the sensitive values they might carry on their payloads, thus allowi…

cve.org Apache · Software · Foundation:Apache 14 Sep 2026

CVE-2026-75030 CWE-862 N/A

Apache Syncope: Incomplete authorization checks for Group members deprovisioning

Missing Authorization vulnerability in Apache Syncope. An administrator with task execution entitlements might be able to mass (de)provision group members, regardless of their group-related administration capabilities…

cve.org Apache · Software · Foundation:Apache 14 Sep 2026

CVE-2026-77051 CWE-89 N/A

Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements can achieve execution of arbitrary SQL via stacked qu…

cve.org Apache · Software · Foundation:Apache 14 Sep 2026

CVE-2026-73668 CWE-863 N/A

Apache Syncope: Cross-realm disclosure of confidential ConnId bundles configuration values

Incorrect Authorization vulnerability in Apache Syncope. An administrator with adequate entitlements in a given Realm may be able to read via REST the full Connector configuration, confidential properties included, …

cve.org Apache · Software · Foundation:Apache 14 Sep 2026

CVE-2026-77147 CWE-94 N/A

Apache Syncope: Groovy Sandbox escape for empty CommandArgs

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy Command class containing untrusted…

cve.org Apache · Software · Foundation:Apache 14 Sep 2026

CVE-2026-90938 CWE-306 8.6

LangBot through 0.4.17 Unauthenticated Plugin Registration via WebSocket

LangBot's plugin runtime (pip package langbot_plugin) through 0.4.17 starts a debug WebSocket server on 0.0.0.0:5401 (/plugin/ws) whose authentication is gated on plugin_debug_key, which defaults to an empty string and i…

cve.org langbot-app:LangBot 14 Sep 2026

CVE-2026-90937 CWE-93 9.9

froxlor before 2.2.5 nginx/Apache Configuration Injection via subdomain redirect URL

froxlor versions before 2.2.5 fail to validate newline characters in subdomain redirect URLs, allowing authenticated customers to inject arbitrary nginx or Apache configuration directives. Attackers can supply URLs conta…

cve.org froxlor:froxlor 14 Sep 2026

CVE-2026-90936 CWE-200 4.3

Froxlor before 2.3.7 Information Disclosure via customer_email.php

Froxlor before 2.3.7 fails to properly scope sender alias lookups to the current customer in customer_email.php. Authenticated attackers can enumerate global sender alias IDs and read other customers' allowed sender valu…

cve.org froxlor:froxlor 14 Sep 2026