Posts of last few hours

CVE-2026-82078
Currently trending CVE - Hype Score: 9 - An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver classes based on configurable driver names without validating against an allowlist of approved drivers. If an ...
https://cvemon.intruder.io/cves/CVE-2026-82078
CVE-2026-53706 | vbpf Prevail up to 0.2.3 eBPF Verifier input validation
A vulnerability was found in vbpf Prevail up to 0.2.3 and classified as problematic. Affected is an unknown function of the component eBPF Verifier. Such manipulation leads to improper input validation. This vulnerability is documented as CVE-2026-53706. The attack needs to be performed locally. There is not any exploit available. It is suggested to upgrade the affected component.
https://vuldb.com/vuln/398277
CVE-2026-84380 | Pydantic Httpx2 up to 2.10.x Request Framing _models.py Request._prepare request smuggling (EUVD-2026-70248)
A vulnerability has been found in Pydantic Httpx2 up to 2.10.x and classified as problematic. This impacts the function Request._prepare of the file src/httpx2/httpx2/_models.py of the component Request Framing. This manipulation causes http request smuggling. This vulnerability is registered as CVE-2026-84380. Remote exploitation of the attack is possible. No exploit is available. The affected component should be upgraded.
https://vuldb.com/vuln/398276
CVE-2026-84379 | Pydantic HTTPX2 up to 2.10.x Multipart Parser _multipart.py FileField.render_headers injection
A vulnerability, which was classified as problematic, was found in Pydantic HTTPX2 up to 2.10.x. This affects the function FileField.render_headers of the file src/httpx2/httpx2/_multipart.py of the component Multipart Parser. The manipulation results in injection. This vulnerability is cataloged as CVE-2026-84379. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.
https://vuldb.com/vuln/398275
CVE-2026-84378 | Pydantic Httpx2 up to 2.9.x Server-Sent Events Parser _sse.py _SSELineDecoder.decode information exposure through microarchitectural state after transient execution
A vulnerability, which was classified as problematic, has been found in Pydantic Httpx2 up to 2.9.x. The impacted element is the function _SSELineDecoder.decode of the file src/httpx2/httpx2/_sse.py of the component Server-Sent Events Parser. The manipulation leads to information exposure through microarchitectural state after transient execution. This vulnerability is listed as CVE-2026-84378. The attack may be initiated remotely. There is no available exploit. It is advisable to upgrade the affected component.
https://vuldb.com/vuln/398274
Weekly Threat Bulletin – September 2nd, 2026
These are the top threats you should know about this week.
https://www.f5.com/labs/articles/weekly-threat-bulletin-september-2nd-2026
CVE-2026-82522 | libjxl up to 0.11.x Container Box Parser integer underflow
A vulnerability classified as critical was found in libjxl up to 0.11.x. The affected element is an unknown function of the component Container Box Parser. Executing a manipulation can lead to integer underflow. This vulnerability is tracked as CVE-2026-82522. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.
https://vuldb.com/vuln/398273
GPEWebDefender — Updated!
A web-attack monitor. It sits next to nginx / Caddy / the app, tails access logs, and tells you whe
https://buaq.net/go-439658.html
CVE-2026-55221 | malach-it boruta-server up to 0.9.x information disclosure
A vulnerability classified as problematic has been found in malach-it boruta-server up to 0.9.x. Impacted is an unknown function. Performing a manipulation results in information disclosure. This vulnerability is identified as CVE-2026-55221. The attack can be initiated remotely. There is not any exploit available. It is recommended to upgrade the affected component.
https://vuldb.com/vuln/398272
CVE-2026-49249 | Malach-IT Boruta Server up to 0.9.x UserSettingsController BorutaIdentityWeb.UserSettingsController.update User resource consumption
A vulnerability described as problematic has been identified in Malach-IT Boruta Server up to 0.9.x. This issue affects the function BorutaIdentityWeb.UserSettingsController.update of the component UserSettingsController. Such manipulation of the argument User leads to resource consumption. This vulnerability is referenced as CVE-2026-49249. It is possible to launch the attack remotely. No exploit is available. Upgrading the affected component is recommended.
https://vuldb.com/vuln/398271
CVE-2026-84377 | BerriAI LiteLLM up to 1.88.5/1.96.1 Request Validation auth_utils.py server-side request forgery
A vulnerability marked as problematic has been reported in BerriAI LiteLLM up to 1.88.5/1.96.1. This vulnerability affects unknown code of the file litellm/proxy/auth/auth_utils.py of the component Request Validation. This manipulation of the argument api_base/base_url/model_list/fallbacks/litellm_credential_name causes server-side request forgery. The identification of this vulnerability is CVE-2026-84377. It is possible to initiate the attack remotely. There is no exploit available. It is suggested to upgrade the affected component.
https://vuldb.com/vuln/398270
CVE-2026-49832 | DSpace up to 8.3/9.2/10-rc1 Velocity Templates code injection
A vulnerability labeled as problematic has been found in DSpace up to 8.3/9.2/10-rc1. This affects an unknown part of the component Velocity Templates. The manipulation results in code injection. This vulnerability was named CVE-2026-49832. The attack may be performed from remote. There is no available exploit. The affected component should be upgraded.
https://vuldb.com/vuln/398269
CVE-2026-53649 | BishopFox Joro up to 1.1.0 Default Proxy Mode improper authentication
A vulnerability identified as critical has been detected in BishopFox Joro up to 1.1.0. Affected by this issue is some unknown functionality of the component Default Proxy Mode. The manipulation leads to improper authentication. This vulnerability is uniquely identified as CVE-2026-53649. The attack is possible to be carried out remotely. No exploit exists. You should upgrade the affected component.
https://vuldb.com/vuln/398268
CVE-2026-56847 | Node.js up to 22.23.1/24.18.0/26.5.0 Permission Model trace_events.createTracing.enable permission (Nessus ID 335502 / WID-SEC-2026-2585)
A vulnerability marked as critical has been reported in Node.js up to 22.23.1/24.18.0/26.5.0. This issue affects the function trace_events.createTracing.enable of the component Permission Model. This manipulation causes permission issues. The identification of this vulnerability is CVE-2026-56847. It is possible to initiate the attack remotely. There is no exploit available.
https://vuldb.com/vuln/384620
CVE-2026-56850 | Node.js prior 22.23.1/24.18.0/26.5.0 HTTPS Agent certificate validation (Nessus ID 335502 / WID-SEC-2026-2585)
A vulnerability was found in Node.js and classified as problematic. Affected by this vulnerability is an unknown functionality of the component HTTPS Agent. Such manipulation leads to improper certificate validation. This vulnerability is documented as CVE-2026-56850. The attack can be executed remotely. There is not any exploit available. It is suggested to upgrade the affected component.
https://vuldb.com/vuln/384627
CVE-2026-56848 | Node.js up to 22.23.1/24.18.0/26.5.0 HTTP/2 nghttp2_session_mem_send use after free (Nessus ID 335502 / WID-SEC-2026-2585)
A vulnerability was found in Node.js up to 22.23.1/24.18.0/26.5.0. It has been declared as critical. Impacted is the function nghttp2_session_mem_send of the component HTTP2. Such manipulation leads to use after free. This vulnerability is traded as CVE-2026-56848. The attack may be launched remotely. There is no exploit available.
https://vuldb.com/vuln/385875
CVE-2026-56846 | nodejs Node.js up to 22.23.1/24.18.0 HTTP/2 memory allocation (EUVD-2026-52564 / Nessus ID 335502)
A vulnerability was found in nodejs Node.js up to 22.23.1/24.18.0. It has been declared as problematic. This affects an unknown function of the component HTTP2. The manipulation results in uncontrolled memory allocation. This vulnerability is cataloged as CVE-2026-56846. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.
https://vuldb.com/vuln/385735
CVE-2026-56865 | Go x-mod-sumdb-tlog signature verification (WID-SEC-2026-2850)
A vulnerability described as critical has been identified in Go. This impacts an unknown function of the component x-mod-sumdb-tlog. Executing a manipulation can lead to improper verification of cryptographic signature. This vulnerability is handled as CVE-2026-56865. The attack can be executed remotely. There is not any exploit available.
https://vuldb.com/vuln/389927
CVE-2026-48934 | Node.js up to 22.22.3/24.16.0/26.3.0 information disclosure (Nessus ID 323047 / WID-SEC-2026-2585)
A vulnerability categorized as problematic has been discovered in Node.js up to 22.22.3/24.16.0/26.3.0. This vulnerability affects unknown code. Such manipulation leads to information disclosure. This vulnerability is uniquely identified as CVE-2026-48934. The attack can be launched remotely. No exploit exists. It is advisable to upgrade the affected component.
https://vuldb.com/vuln/374103
CVE-2026-56862 | Go crypto tls up to 1.25.12/1.26.5 Client allocation of resources (Nessus ID 341090 / WID-SEC-2026-2850)
A vulnerability, which was classified as problematic, has been found in Go crypto tls up to 1.25.12/1.26.5. This impacts an unknown function of the component Client Handler. The manipulation leads to allocation of resources. This vulnerability is referenced as CVE-2026-56862. Remote exploitation of the attack is possible. No exploit is available. It is advisable to upgrade the affected component.
https://vuldb.com/vuln/389916

Managed ad