⚠️ Quadratic HTML Traversal Enables Remote Resource Exhaustion
Teams using html_sanitize_ex to process untrusted HTML should upgrade to 1.5.3 or later promptly. Prioritize internet-facing sanitization endpoints because relatively small requests can consume disproportionate server resources.
CVE-2026-68750 is an algorithmic-complexity vulnerability in the traversal engine of rrrene html_sanitize_ex from 0.3.1 before 1.5.3. An unauthenticated remote attacker can submit a flat run of sibling elements in sanitized HTML to trigger quadratic processing and exhaust server CPU and memory. It is rated HIGH with CVSS 8.2.
🔗 Read more 🔗
Source: NVD
🧨 Malformed CSS Can Stall html_sanitize_ex Servers
Upgrade html_sanitize_ex to 1.5.3 or later as soon as practical, especially where users can submit HTML or CSS. Apply request-size limits and rate limiting until the update is deployed.
CVE-2026-68749 is an inefficient regular-expression vulnerability in the CSS scrubber of rrrene html_sanitize_ex from 0.3.1 before 1.5.3. An unauthenticated remote attacker can submit a long CSS declaration that causes quadratic regex processing and CPU exhaustion. It is rated HIGH with CVSS 8.2.
🔗 Read more 🔗
Source: NVD
🔓 Forged JWT Claims Bypass Neo4j GraphQL Subscription Controls
Applications using GraphQL subscriptions should upgrade urgently to 7.5.6+ or 5.12.14+ and review whether sensitive events may have been exposed. Version 6 is end-of-life and should be migrated because it will not receive a fix.
CVE-2026-5423 affects @neo4j/graphql versions prior to 7.5.6 and allows unauthenticated WebSocket clients to supply forged, pre-decoded JWT claims through subscription connectionParams. The library accepts those claims without verifying authenticity, potentially exposing subscription events restricted to particular users or roles. It is rated HIGH with CVSS 8.2.
🔗 Read more 🔗
Source: NVD
📡 Unauthenticated Command Can Terminate Ground Station
Ground Station operators should upgrade to 0.6.0 or later immediately and restrict port 7000 to trusted networks. Docker deployments deserve particular attention because repeated triggering can create a persistent denial-of-service condition.
CVE-2026-53985 is an unauthenticated denial-of-service vulnerability in Ground Station prior to 0.6.0. Any network peer able to reach the Socket.IO service on port 7000 can send a single restart_service command that terminates the process and disrupts satellite-tracking and radio-processing workloads. It is rated HIGH with CVSS 7.5.
🔗 Read more 🔗
Source: NVD
🛑 OpenChamber Shutdown Endpoint Skips Authentication
OpenChamber administrators should patch or remove external access to the shutdown endpoint immediately. Do not rely on UI_PASSWORD for protection because the vulnerable route executes before authentication.
CVE-2026-53977 is an authentication-bypass vulnerability in OpenChamber 1.11.7. Because the shutdown route is registered before the authentication middleware, an unauthenticated remote attacker can send a POST request to /api/system/shutdown and terminate the server process. It is rated HIGH with CVSS 7.5.
🔗 Read more 🔗
Source: NVD
💥 llama.cpp Android Double Free Risks Crashes and Code Execution
Android applications that include llama.cpp builds b1886 through b7445 should update and rebuild affected binaries promptly. Treat the issue as urgent because it can cause denial of service and may permit arbitrary code execution.
CVE-2026-43622 is a double-free vulnerability in the LLaMA-Android JNI wrapper included in llama.cpp builds b1886 through b7445. Mismatched malloc and C++ delete operations can corrupt heap metadata, allowing attackers to cause process crashes or potentially achieve arbitrary code execution depending on allocator state. It is rated HIGH with CVSS 7.8.
🔗 Read more 🔗
Source: NVD
💉 Creative Mail Plugin Exposes WordPress Sites to SQL Injection
WordPress administrators running the affected Creative Mail versions should update or disable the plugin immediately, particularly when abandoned-cart features are enabled. Review database and web logs for suspicious unauthenticated requests.
CVE-2026-3430 is an unauthenticated SQL-injection vulnerability in the Creative Mail WordPress plugin from 1.6.5 to 1.6.9. An unsanitized parameter is used in an SQL statement when abandoned-cart email is managed by Creative Mail. It is rated HIGH with CVSS 8.6.
🔗 Read more 🔗
Source: NVD
📂 Noncanonical Paths Bypass @fastify/static Route Guards
Fastify applications protecting static subtrees with route-based guards should upgrade to 10.1.3 immediately. Applications relying on the allowedPath option are not affected, but maintainers should verify which protection model their deployment uses.
CVE-2026-18427 is a route-guard bypass in @fastify/static before version 10.1.3. An unauthenticated attacker can use noncanonical path forms involving dot segments, duplicate slashes, encoded dots, or backslashes to miss a guarded route while still reaching and disclosing the protected file. It is rated HIGH with CVSS 7.5.
🔗 Read more 🔗
Source: NVD
🌐 eScriptorium Import Feature Enables Internal Network Requests
eScriptorium operators should patch urgently and restrict import permissions to trusted users. Until fixed, configure a strict domain allowlist and block access to internal networks and metadata-service addresses.
CVE-2026-18359 is a server-side request forgery vulnerability in the METS and IIIF import URI handling of Scripta eScriptorium through 26.04.1. A remote authenticated user can make the server issue arbitrary HTTP requests to internal hosts, including cloud instance metadata services, because IMPORT_ALLOWED_DOMAINS defaults to ‘*’ and address filtering, redirect caps, and timeouts are absent. It is rated HIGH with CVSS 8.5.
🔗 Read more 🔗
Source: NVD
🔑 eScriptorium Users Can Hijack Private OCR Model Access
Organizations sharing an eScriptorium instance among multiple users should patch promptly. Review OCR model permission changes for unexpected grants or revocations, especially where untrusted accounts are present.
CVE-2026-18277 is a missing-authorization vulnerability in Scripta eScriptorium through 26.04.1. A remote authenticated user can grant themselves access to another user’s private OCR model or revoke any user’s OCR model access because the ownership check runs only on the GET rendering path. It is rated HIGH with CVSS 7.1.
🔗 Read more 🔗
Source: NVD
🚨 eScriptorium API Lets Users Alter Others’ Transcriptions
Multi-user eScriptorium deployments should patch with high urgency because the flaw permits direct cross-user data access and destruction. Audit recent API activity and transcription changes for unauthorized object identifiers.
CVE-2026-18258 is an authorization-bypass vulnerability in multiple Scripta eScriptorium API endpoints through 26.04.1. Remote authenticated users can supply primary keys that are resolved through the global model manager, enabling them to read, modify, or delete other users’ transcription content. It is rated HIGH with CVSS 8.8.
🔗 Read more 🔗
Source: NVD
⚙️ aiosend Parses Untrusted Webhooks Before Signature Checks
Users exposing aiosend webhook endpoints should upgrade to 3.0.7 promptly. Until then, enforce request-body size limits, reject oversized requests before JSON parsing, and rate-limit the endpoint.
CVE-2026-70646 is a resource-exhaustion vulnerability in aiosend prior to version 3.0.7. WebhookHandler.feed_update() deserializes the full JSON request body before validating its HMAC signature, allowing an unauthenticated attacker to consume CPU and memory with arbitrary payloads that are ultimately rejected. It is rated HIGH with CVSS 7.5.
🔗 Read more 🔗
Source: NVD