Reserved but Public CVEs

CVE-2026-45517First seen Sep 9, 2026

CVE-2026-45529First seen Sep 9, 2026

CVE-2026-49913First seen Sep 9, 2026

CVE-2026-59176 is a high-severity improper inclusion of functionality from an untrusted control sphere vulnerability in functype-mcp-server before version 1.4.4. The set_functype_version MCP tool accepts an unsanitized pnpm package-specifier as a version value, installs the resulting package under the functype alias, and dynamically imports its CLI module. An attacker can supply an alias, local-path, or remote package specifier that causes attacker-controlled package content to be imported and executed by the MCP server process.

CVE-2026-59176First seen Sep 10, 2026

CVE-2026-59158 is a high-severity insufficiently protected credentials vulnerability in nuxt-ollama and related packages before version 1.3.1. The module merges configured options, including an Ollama API key, into Nuxt public runtime configuration. That public configuration is serialized into server-side-rendered HTML and is therefore accessible to unauthenticated browser clients. Version 1.3.1 separates the API key from public configuration and retains it in private server-side runtime configuration.

CVE-2026-59158First seen Sep 10, 2026

CVE-2026-59172 is an arbitrary code execution vulnerability in the github.com/candid82/joker linter. When invoked with linting enabled, Joker loads and executes linter customization code from a repository-local configuration location. Consequently, linting an untrusted repository can execute attacker-controlled code in the context of the Joker process. Joker 1.8.2 changes this behavior so executable linter customizations are loaded only from the user’s home configuration directory.

CVE-2026-59172First seen Sep 10, 2026

CVE-2025-24979 is a server-side request forgery vulnerability in LF Edge eKuiper external-service registration and HTTP-invocation functionality. An authenticated, highly privileged party able to register external services or create rules through the management interface can supply destinations that cause the eKuiper host to make requests to unintended network resources, including internal, loopback, link-local, multicast, unspecified, and cloud-metadata endpoints.

CVE-2025-24979First seen Sep 10, 2026

CVE-2025-24978 is a stored/self cross-site scripting vulnerability in LF Edge eKuiper external-service creation and update functionality. An authenticated user with management API access can supply a crafted external-service name containing HTML or script content. In affected versions, the value may be rendered by the administrative interface without appropriate escaping, causing attacker-controlled script to execute in the browser of a user viewing the service entry. Version 2.4.0 introduces strict alphanumeric identifier validation through validate.ValidateID for external-service creation and update operations.

CVE-2025-24978First seen Sep 10, 2026

CVE-2026-79605 is an out-of-bounds memory-access vulnerability in Tapdisk, the userspace xen-blkback implementation used by the XAPI toolstack. Tapdisk does not enforce an upper bound on blkif->last_sect. A malicious guest can supply a value greater than 7, causing Tapdisk to read from or write beyond the mapped grant memory region. The flaw affects all Tapdisk versions.

CVE-2026-79605First seen Sep 9, 2026

CVE-2026-79606 is an out-of-bounds memory-corruption vulnerability in Xen Tapdisk, the userspace xen-blkback implementation used by the XAPI toolstack. Incorrect bounds checking of the gcopy_segs[] object permits a guest-controlled nr_segments value from 12 through 32 to write beyond the intended object and corrupt adjacent memory. All Tapdisk versions are affected.

CVE-2026-79606First seen Sep 9, 2026

First seen Aug 30, 2026

First seen Sep 7, 2026

CVE-2026-16658 is an OS command injection vulnerability in the community.proxmox Ansible collection's proxmox_pct_remote connection plugin. Its _build_pct_command() method builds a pct exec command through unquoted string concatenation and submits it to the Proxmox host shell using Paramiko. Shell metacharacters in values incorporated into the constructed command can therefore be evaluated by the hypervisor shell rather than being passed as data to the intended LXC container.

CVE-2026-16658First seen Sep 3, 2026

CVE-2026-17516First seen Aug 30, 2026

CVE-2026-18054First seen Aug 30, 2026

NLTK before 3.10.3 incompletely validates JVM arguments supplied through the per-call options parameter of nltk.internals.java(). User-controlled java_options passed by GenericStanfordParser, StanfordTagger, StanfordTokenizer, or StanfordSegmenter can bypass the intended JVM-option validation, allowing injection of arbitrary JVM flags.

CVE-2026-12841First seen Sep 2, 2026

CVE-2026-61476 is a medium-severity vulnerability affecting QEMU packages. The available technical information does not identify the vulnerable function or flaw class. Upstream fixes are present in QEMU v11.0.4 and v11.1.0-rc2. Amazon Linux identifies its affected qemu packages in Amazon Linux 2 Core and Amazon Linux 2023 as awaiting fixes; Amazon Linux 2 Core qemu-guest-agent and qemu-kvm packages are not affected.

CVE-2026-61476First seen Aug 30, 2026

CVE-2026-61405First seen Aug 30, 2026

CVE-2026-58581First seen Aug 30, 2026

CVE-2026-58582 is a medium-severity vulnerability in QEMU. Technical details identifying the affected component or vulnerable function are not currently available. Upstream fixes are included in QEMU v11.0.4 and v11.1.0-rc2.

CVE-2026-58582First seen Aug 30, 2026

CVE-2026-27110 is an improper access-control vulnerability in Dell AppSync versions 4.6.0.4 and 4.6.1.0. A remotely accessible low-privileged authenticated attacker can exploit the flaw without user interaction to bypass protection mechanisms and obtain unauthorized access. The vulnerability has a CVSS v3.1 base score of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N).

CVE-2026-27110First seen Aug 31, 2026

CVE-2026-28258 is an improper authorization vulnerability in Dell AppSync versions 4.6.0.4 and 4.6.1.0. Insufficient authorization enforcement allows a remotely authenticated low-privileged attacker to access functionality or resources without the intended authorization, resulting in unauthorized access.

CVE-2026-28258First seen Aug 31, 2026

CVE-2026-28257 is an improper authorization vulnerability in Dell AppSync versions 4.6.0.4 and 4.6.1.0. An authenticated remote attacker with low privileges can exploit insufficient authorization enforcement to obtain unauthorized access. The vulnerability is rated CVSS v3.1 7.6 (AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L).

CVE-2026-28257First seen Aug 31, 2026

CVE-2026-77682First seen Aug 22, 2026

CVE-2026-81501First seen Aug 28, 2026