CVE Vulnerability Catalog

CVE-2026-40957 is a frameable content vulnerability in the Secure Access server login page prior to 14.55. Attackers with control of a malicious web site could use it to potentially steal credentials from an unwary administrator.

CVE-2026-40952 is a privilege misconfiguration in the Secure Access installer for Windows client and server prior to version 14.55. Attackers with local access can exploit this to elevate privileges to Administrator when Secure Access is installed in a non-default location.

In TDengine before version 3.4.1.15, the transDecompressMsg() function reads the STransCompMsg.contLen field without first validating that the RPC packet contains the 8-byte STransCompMsg structure, leading to an unauthenticated out-of-bounds read, uncontrolled allocation, integer underflow, and server crash.

In TDengine prior to version 3.4.1.15, a user with create UDF privilege can upload a crafted shared library and install it as a user-defined function, then execute arbitrary C code on the server side through database queries.

In TDengine version 3.4.1.6 and earlier, the trimString() function in parUtil.c incorrectly checks string length before processing SQL escape sequences, leading to a one-byte out-of-bounds write to the stack buffer tmpTokenBuf. This can cause denial of service and potentially remote code execution.

Repomix prior to version 1.14.1 contains a vulnerability in the execGitShallowClone function where the --remote-branch parameter is passed directly to git fetch and git checkout without validation or --end-of-options. This allows injection of Git options like --upload-pack, bypassing validateGitUrl() checks and enabling command execution via local or SSH transports.

Dashy before version 4.0.8 contains a vulnerability that allows unauthenticated users or non-admin authenticated users to write changes to the main config.yaml file through the config-saving functionality, despite configured permissions. This enables unauthorized modification of dashboard configuration and potential service disruption.

OS command injection vulnerability in the npm package loading component of AWS jsii-diff before version 1.131.0 may allow context-dependent attackers to execute arbitrary commands via crafted package specifiers passed to the npm: source argument.

The Gravity Forms plugin for WordPress is vulnerable to Directory Traversal in all versions up to and including 2.10.4 via the 'gform_uploaded_files' parameter. Unauthenticated attackers can read arbitrary files on the server, potentially exposing sensitive information.

A broken access control vulnerability in Immich before version 3.0.3 in the PUT /albums/:id/user/:userId endpoint allows shared album editors to modify member roles without owner-only restrictions. Attackers with editor access can demote the album owner to editor and promote themselves to owner in sequential requests, gaining full control including deletion and eviction capabilities.

A missing authorization vulnerability in BloodHound through version 9.4.0, fixed in commit 8f79035, allows any authenticated user to modify the global graph schema via custom-nodes API endpoints.

A vulnerability in Kanboard up to version 1.2.52 (fixed in commit 564cc30) allows an authenticated user who is a member of at least one project to move (hide/corrupt) tasks from any other project, including private ones they have no access to. The issue is in the save() method of BoardAjaxController, which does not verify that the supplied task_id actually belongs to the attacker-supplied project_id.

A vulnerability in PyTorch Lightning up to version 2.6.5 (fixed in commit d710d68) allows remote code execution via the _load_state function, which imports and executes attacker-controlled module names from _instantiator hyperparameters in checkpoint files. Attackers can craft malicious checkpoint files that bypass weights_only=True protections and execute arbitrary code when LightningModule.load_from_checkpoint is called.

GPUStack through version 2.2.1 contains an unauthenticated information disclosure vulnerability that allows attackers to access sensitive inference logs and modify worker configuration via unprotected /serveLogs and /debug endpoints on the worker port. Attackers can enumerate model instance IDs to stream serving logs containing prompts and completions, change log levels, and read memory profiling data without any authentication.

Dell ThinOS 10 versions prior to 2605_10.2100 contain an Obsolete Feature in UI vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to unauthorized access.

Better Auth versions 1.6.0 through 1.6.11 have a vulnerability in the POST /oauth2/token endpoint for the authorization_code grant. The authorization code is checked and deleted in a non-atomic find-then-delete sequence, allowing two concurrent requests to read the same code and mint independent access, refresh, and ID tokens.

Better Auth library for TypeScript has a vulnerability in the POST /oauth2/token endpoint for the refresh_token grant. A non-atomic read, validate, revoke, and mint sequence allows concurrent requests with the same parent refresh token to bypass the revocation check and create forked refresh-token families.

A vulnerability in the Better Auth library allows unauthorized linking of OAuth accounts with existing user accounts. The auto-link gate accepts email verification from the OAuth provider without checking if the local user's email is verified. An attacker can register an account with the victim's email and then link it to the victim's OAuth identity.

Vulnerability in Better Auth library versions 1.2.10 through 1.6.11. The POST /sso/register endpoint of the @better-auth/sso plugin allows any organization member to attach a new SSO provider because registerSSOProvider only checks for a membership row and does not require an owner or admin role. This allows an attacker to control OIDC or SAML providers and drive organization provisioning via /sso/callback/{providerId}.

Better Auth library for TypeScript has a vulnerability in the organization plugin that allows a user with an unverified session for the invited email address to accept an invitation after obtaining the invitation ID. The issue affects versions prior to 1.6.11 and versions 1.6.14 and later when invitation IDs are obtainable outside the invited mailbox and requireEmailVerificationOnInvitation: true is not enabled.