VulDB Recent Entries

A vulnerability categorized as problematic has been discovered in a2ui-project a2ui up to 0.10.6. This impacts an unknown function of the file renderers/web_core/src/v0_9/rendering/data-context.ts of the component data-context Resolver. Such manipulation leads to resource consumption. This vulnerability is listed as CVE-2026-118271. The attack may be performed from remote. In addition, an exploit is available. Applying a patch is advised to resolve this issue.

A vulnerability was found in Eugeny russh up to 0.2.4. It has been rated as problematic. This affects the function PageantStream::new of the file pageant/src/wmmessage.rs of the component PageantStream. This manipulation causes uncontrolled memory allocation. This vulnerability is tracked as CVE-2026-116775. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is advised.

A vulnerability was found in Eugeny russh up to 0.64.x. It has been declared as problematic. The impacted element is the function ChannelTx::poll_writable of the file russh/src/channels/io/tx.rs of the component Channel Open Parsing. The manipulation of the argument maximum_packet_size results in resource consumption. This vulnerability is identified as CVE-2026-116774. The attack can be executed remotely. There is not any exploit available. It is recommended to upgrade the affected component.

A vulnerability was found in Eugeny russh up to 0.64.x. It has been classified as problematic. The affected element is the function handle_ext_info of the file russh/src/client/encrypted.rs of the component SSH Agent Protocol. The manipulation leads to uncontrolled memory allocation. This vulnerability is referenced as CVE-2026-116773. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is recommended.

A vulnerability was found in Datadog dd-trace-js up to 5.131.0/6.20.0 and classified as problematic. Impacted is an unknown function of the component Query String Obfuscation. Executing a manipulation can lead to incorrect regular expression. The identification of this vulnerability is CVE-2026-116693. The attack may be launched remotely. There is no exploit available. It is suggested to upgrade the affected component.

A vulnerability has been found in Eugeny russh up to 0.64.x and classified as problematic. This issue affects the function russh::keys::agent::server::serve of the file russh/src/keys/agent/server.rs of the component Agent Server. Performing a manipulation results in resource consumption. This vulnerability was named CVE-2026-116696. The attack may be initiated remotely. There is no available exploit. The affected component should be upgraded.

A vulnerability, which was classified as problematic, was found in rgrove Crass up to 1.0.7. This vulnerability affects unknown code. Such manipulation leads to improper input validation. This vulnerability is uniquely identified as CVE-2026-116695. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

A vulnerability, which was classified as problematic, has been found in OpenTelemetry Python up to 1.44.x. This affects the function JaegerPropagator.extract of the component JaegerPropagator. This manipulation causes denial of service. This vulnerability is handled as CVE-2026-116694. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

A vulnerability classified as critical was found in Mlflow up to 3.16.x. Affected by this issue is the function Scorer.model_validate_json of the file mlflow/genai/scorers/base.py of the component Scorer. The manipulation results in deserialization. This vulnerability is known as CVE-2026-116692. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is advised.

A vulnerability classified as problematic has been found in MLflow up to 3.16.x. Affected by this vulnerability is the function mlflow.crewai.autolog of the file mlflow/crewai/autolog.py of the component CrewAI Autolog. The manipulation leads to missing encryption of sensitive data. This vulnerability is traded as CVE-2026-116691. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

A vulnerability described as critical has been identified in Python Software Foundation Python up to 3.15.x. Affected is an unknown function of the component HTTP Response Parsing. Executing a manipulation can lead to improper input validation. This vulnerability appears as CVE-2026-103995. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is recommended.

A vulnerability marked as critical has been reported in Sunhillo SureLine up to 9.1.4. This impacts the function checkLogin of the file libwebcmn.so. Performing a manipulation of the argument Username results in improper authentication. This vulnerability is reported as CVE-2026-112352. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

A vulnerability labeled as problematic has been found in CKEditor up to 47.7.3/48.5.0. This affects an unknown function. Such manipulation leads to cross site scripting. This vulnerability is documented as CVE-2026-116687. The attack can be executed remotely. There is not any exploit available. The affected component should be upgraded.

A vulnerability identified as critical has been detected in CKEditor up to 47.7.3/48.5.0. The impacted element is an unknown function of the component Style Attribute Processing. This manipulation causes miscalculated null termination. This vulnerability is registered as CVE-2026-116688. Remote exploitation of the attack is possible. No exploit is available. You should upgrade the affected component.

A vulnerability categorized as problematic has been discovered in follow-redirects up to 1.16.1. The affected element is an unknown function. The manipulation of the argument sensitiveHeaders results in permissive cross-domain policy with untrusted domains. This vulnerability is cataloged as CVE-2026-116689. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

A vulnerability was found in Mlflow up to 3.16.x. It has been rated as problematic. Impacted is the function _create_model_version of the component Prompt Branch. The manipulation leads to information disclosure. This vulnerability is listed as CVE-2026-116690. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

A vulnerability was found in Sunhillo SureLine up to 9.1.4. It has been declared as very critical. This issue affects some unknown processing of the file networkDiag.cgi of the component Network Diagnostic. Executing a manipulation of the argument ipAddr/dnsAddr can lead to os command injection. This vulnerability is tracked as CVE-2026-112351. The attack can be launched remotely. No exploit exists. It is recommended to upgrade the affected component.

A vulnerability was found in modelcontextprotocol python-sdk up to 1.29.x/2.1.x. It has been classified as critical. This vulnerability affects unknown code of the component Tool Call. Performing a manipulation results in server-side request forgery. This vulnerability is identified as CVE-2026-116686. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is recommended.

A vulnerability was found in Sunhillo SureLine up to 9.1.4 and classified as problematic. This affects an unknown part of the file radarUpdater.cgi of the component radarUpdater. Such manipulation of the argument filename leads to path traversal. This vulnerability is referenced as CVE-2026-112350. It is possible to launch the attack remotely. No exploit is available. It is suggested to upgrade the affected component.

A vulnerability has been found in modelcontextprotocol python-sdk up to 1.29.x/2.1.x and classified as problematic. Affected by this issue is some unknown functionality of the component streamable_http_client. This manipulation causes open redirect. The identification of this vulnerability is CVE-2026-116685. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.