Vuldb Updates

A vulnerability was found in Dexmal Dexbotic up to 0.2.0. It has been classified as critical. Affected by this vulnerability is the function load_pretrained_gr00t of the file dexbotic/model/gr00tsonic/gr00tsonic_arch.py of the component gr00tsonic Checkpoint Loader. This manipulation of the argument weight_map causes path traversal. This vulnerability is registered as CVE-2026-117510. Remote exploitation of the attack is possible. Furthermore, an exploit is available. The project was informed of the problem early through an issue report but has not responded yet.

A vulnerability has been found in Tidewave AI Tidewave up to 0.9.1 and classified as problematic. This issue affects some unknown processing of the component Host Header Validation. The manipulation leads to permissive cross-domain policy with untrusted domains. This vulnerability is traded as CVE-2026-109823. It is possible to initiate the attack remotely. There is no exploit available. The affected component should be upgraded.

A vulnerability categorized as problematic has been discovered in FreeRDP up to 3.31.x. Impacted is the function winpr_convert_from_jpeg of the component JPEG Conversion. The manipulation results in heap-based buffer overflow. This vulnerability is cataloged as CVE-2026-110839. The attack may be launched remotely. There is no exploit available. It is advisable to upgrade the affected component.

A vulnerability, which was classified as problematic, was found in FreeRDP up to 3.31.x. This affects the function persistent_cache_read_entry_v3 of the component Persistent Cache. The manipulation of the argument width/height results in heap-based buffer overflow. This vulnerability was named CVE-2026-111379. The attack needs to be approached locally. There is no available exploit. You should upgrade the affected component.

A vulnerability, which was classified as critical, has been found in Libexpat up to 2.8.3. The affected element is an unknown function. Performing a manipulation results in use after free. This vulnerability is reported as CVE-2026-76957. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

A vulnerability, which was classified as problematic, has been found in a2aproject a2a-java up to 1.2.0.Final. The impacted element is the function queue.offer of the component ChildQueue. Performing a manipulation results in resource consumption. This vulnerability is identified as CVE-2026-117505. The attack can be initiated remotely. There is not any exploit available. It is advisable to upgrade the affected component.

A vulnerability marked as critical has been reported in Mozilla Firefox up to 153.5/158. This affects an unknown function of the component Navigation. Performing a manipulation results in improper isolation or compartmentalization. This vulnerability is reported as CVE-2026-117976. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.

A vulnerability identified as critical has been detected in Mozilla Firefox up to 158. Affected by this issue is some unknown functionality of the component Navigation Component. The manipulation leads to improper privilege management. This vulnerability is listed as CVE-2026-118008. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

A vulnerability categorized as problematic has been discovered in Getgrav Grav. This affects the function Debugger::isDebuggerRequestAuthorized of the component Debugger. Such manipulation leads to authorization bypass. This vulnerability is listed as CVE-2026-117604. The attack may be performed from remote. There is no available exploit. It is advisable to upgrade the affected component.

A vulnerability was found in Mozilla Firefox up to 153.5/158. It has been classified as critical. This affects an unknown function of the component IPC. This manipulation causes race condition. The identification of this vulnerability is CVE-2026-117999. It is possible to initiate the attack remotely. There is no exploit available. Upgrading the affected component is recommended.

A vulnerability was found in py-pdf fpdf2 up to 2.8.7. It has been rated as problematic. This issue affects the function FPDF.image/FPDF.write_html of the component Shared Image Loader. This manipulation causes server-side request forgery. This vulnerability is handled as CVE-2026-114609. The attack can be initiated remotely. There is not any exploit available. Upgrading the affected component is advised.

A vulnerability, which was classified as problematic, was found in a2aproject a2a-java up to 1.2.0.Final. This affects the function InMemoryPushNotificationConfigStore.setInfo of the file extras/push-notification-config-store-database-jpa/src/main/java/org/a2aproject/sdk/extras/pushnotificationconfigstore/database/jpa/JpaDatabasePushNotificationConfigStore.java of the component Push Notification Config Store. Executing a manipulation can lead to resource consumption. This vulnerability is tracked as CVE-2026-117506. The attack can be launched remotely. No exploit exists. You should upgrade the affected component.

A vulnerability identified as problematic has been detected in Super Forms Plugin up to 6.3.315 on WordPress. Impacted is an unknown function. Performing a manipulation results in information disclosure. This vulnerability is identified as CVE-2026-28167. The attack can be initiated remotely. There is not any exploit available.

A vulnerability identified as critical has been detected in FreeRDP up to 2.x/3.31.x. Affected by this vulnerability is an unknown functionality of the component Tile Rendering. The manipulation leads to out-of-bounds read. This vulnerability is traded as CVE-2026-109242. It is possible to initiate the attack remotely. There is no exploit available. You should upgrade the affected component.

A vulnerability was found in FreeRDP up to 3.31.x. It has been rated as problematic. This issue affects some unknown processing of the component Shadow Server. The manipulation leads to injection. This vulnerability is listed as CVE-2026-110838. The attack may be initiated remotely. There is no available exploit. Upgrading the affected component is advised.

A vulnerability, which was classified as problematic, has been found in FreeRDP up to 3.31.x. This impacts the function WTSProcessChannelData of the component Static Virtual Channel. Performing a manipulation results in resource consumption. This vulnerability was named CVE-2026-111377. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.

A vulnerability was found in FreeRDP up to 3.31.x. It has been classified as problematic. This affects the function parse_nla_mode_pdu of the component NLA Parsing. This manipulation causes resource consumption. This vulnerability is tracked as CVE-2026-111378. The attack is possible to be carried out remotely. No exploit exists. Upgrading the affected component is recommended.

A vulnerability, which was classified as critical, has been found in Oracle Shipping Execution up to 12.2.15. The affected element is an unknown function of the component Workflow Events. Performing a manipulation results in improper access controls. This vulnerability is reported as CVE-2026-83366. The attack is possible to be carried out remotely. No exploit exists. It is advisable to upgrade the affected component.

A vulnerability labeled as problematic has been found in pypa virtualenv up to 21.14.8. The affected element is the function quote of the file activate.xsh of the component Xonsh Activation. Such manipulation of the argument XONSH_ENCODING leads to encoding error. This vulnerability is listed as CVE-2026-113718. The attack must be carried out locally. There is no available exploit. The affected component should be upgraded.

A vulnerability marked as problematic has been reported in Oracle HRMS up to 12.2.15. Impacted is an unknown function of the component Mobile Applications. This manipulation causes improper privilege management. This vulnerability is tracked as CVE-2026-83377. The attack is possible to be carried out remotely. No exploit exists. It is suggested to upgrade the affected component.