CVE-2026-65165

Unauthorized Node Access via Manipulated Nodelist in NVIDIA Slurm

NVIDIA Slurm contains a vulnerability where a user could deliberately alter the provided nodelist alongside the --distribution=arbitrary option to gain access to compute nodes outside of the current job allocation.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Nvidia

Products

Slurm

CVE-2026-65168

Heap-Based Buffer Overflow in NVIDIA Slurm Socket Handling

NVIDIA Slurm contains an attacker-controlled heap-based buffer overflow in the slurmstepd socket handling code.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Nvidia

Products

Slurm

CVE-2026-121602

Solanum before commit 2ce64de Heap Buffer Overflow via JOIN and SJOIN

Solanum before commit 2ce64de contains a heap-based buffer overflow vulnerability that allows a malicious linked server to corrupt memory by sending overlong channel names in JOIN or SJOIN messages. Attackers controlling a peer server can trigger strcpy and sprintf overflows in ms_join and ms_sjoin to crash the ircd or potentially achieve remote code execution.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Solanum-ircd

Products

Solanum

CVE-2026-121603

Solanum before commit 2ea1382 Buffer Overflow via Server-to-Server KILL Handler

Solanum before commit 2ea1382 contains a buffer overflow vulnerability in ms_kill() that allows malicious linked servers to corrupt memory by sending an overlong kill reason. Attackers controlling a rogue or compromised peer server can send a reason exceeding KILLLEN that overflows a static 512-byte buffer, crashing the ircd or potentially achieving remote code execution.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Solanum-ircd

Products

Solanum

CVE-2026-121625

GNU Gatekeeper before 5.16 Out-of-Bounds Read via RTCP SDES Parsing

GNU Gatekeeper (gnugk) before 5.16 contains an out-of-bounds read vulnerability in ParseRTCP() in ProxyChannel.cxx that allows remote RTP peers to read heap memory past received packets. Attackers can send RTCP SDES items lacking a NUL byte to the media proxy port during proxied H.323 calls with EnableRTCPStats enabled, crashing the gatekeeper.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Willamowius

Products

Gnugk

CVE-2026-121614

Docker Sandboxes host Git executes repository-controlled programs

Docker Sandboxes versions 0.31.0 before 0.50.0 do not neutralize repository-controlled Git configuration when running certain host-side Git commands. An attacker who can modify a host repository's Git configuration, for example through a direct-mode sandbox with the repository mounted read-write, can configure core.fsmonitor or another Git setting that invokes an external program. Git can execute the program during a later clone-mode fetch or, starting in version 0.39.0, an sbx kit push initiated by the user. The program runs on the host with the invoking user's permissions, outside the sandbox's microVM isolation. The read-only host repository mount provided to a clone-mode sandbox does not itself allow that sandbox to modify the host repository's Git configuration. The issue is fixed in version 0.50.0.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Docker

Products

Docker Sandboxes

CVE-2026-88979

Kubeflow Pipelines: Unauthenticated SSRF vulnerability in Kubeflow Pipelines TensorBoard proxy

Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 2.17.0 until 2.18.0, the TensorBoard proxy token introduced by the incomplete remediation for CVE-2026-54745 uses MINIO_SECRET_KEY as its HMAC secret, whose bundled default is publicly known. In an authorization-disabled deployment using that default, an unauthenticated attacker can forge a token containing a chosen viewerName and namespace; the proxy constructs the destination from the viewerName plus the -service suffix, the namespace, and the configured cluster domain, then reads responses on port 80 under the /tensorboard/<viewer>/ path. Resource-name validation and path-traversal rejection remain enforced, authorization-enabled deployments still check access to the selected namespace, and unrestricted metadata access, writes, or service disruption are not established. This issue is fixed in version 2.18.0.

CVSS 3.1 · 5.8 Medium EPSS < 1% KEV · Not listed

Vendors

Kubeflow

Products

Pipelines

CVE-2026-44266

Elo: Remote Code Execution in Elo Ruby backend via unescaped `#{...}` interpolation in emitted string literals and subtype-constraint labels

Elo is a purely functional expression language for no-code tools. Prior to 1.0.1, the Ruby backend in src/compilers/ruby.ts embeds attacker-controlled text in Ruby double-quoted strings without escaping #, so Ruby interpolation forms in the string-literal emitter or the labelled subtype-constraint branch become executable Ruby. The affected entry points include the /try playground with the Ruby target, bin/eloc -t ruby -x, and defaultFormats.elo.parse() followed by Ruby emission. A failing labelled subtype constraint evaluates its message, while an ordinary string literal is evaluated when the compiled Ruby runs, allowing Ruby code and shell command execution through backticks. JavaScript, Python, and SQL emission are not affected by this Ruby-specific path. This issue is fixed in version 1.0.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Enspirit

Products

Elo

CVE-2026-63418

Monitoring Plugins check_icmp: -H argument count overflow leads in setuid-root binary

Monitoring Plugins is a suite of plugins for monitoring applications. From 3.0.0-rc1 until 3.0.1, check_icmp stores the number of hosts supplied through -H or --Host on the command line, or through --extra-opts files containing Host= entries, in an unsigned short. More than 65,535 hosts wrap the counter, causing process_arguments() to allocate an undersized hosts array and then write subsequent entries out of bounds before main() calls setuid(getuid()). On installations where check_icmp is setuid root, a local low-privileged attacker can corrupt heap memory while the process still has root privileges; reliable privilege escalation has not been demonstrated. Installations that use cap_net_raw file capabilities instead of setuid are not exposed to the privilege-escalation consequence. This issue is fixed in version 3.0.1.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Monitoring-plugins

Products

Monitoring-plugins

CVE-2026-108324

Tanium addressed a denial of service vulnerability in Tanium Client.

Tanium addressed a denial of service vulnerability in Tanium Client.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Tanium

Products

Tanium Client

CVE-2026-92211

Pixar Animation Studio OpenUSD Crate File Parsing Double Free Remote Code Execution Vulnerability

Pixar Animation Studio OpenUSD Crate File Parsing Double Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Pixar Animation Studio OpenUSD. Interaction with this library is required to exploit this vulnerability but attack vectors may vary depending on the implementation. The specific flaw exists within the parsing of USDC and USDZ files. The issue results from the lack of validating the existence of an object prior to performing further free operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-30428.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Pixar Animation Studio

Products

Openusd

CVE-2026-21850

HCL AION is affected by multiple security vulnerabilities.

HCL AION is affected by a vulnerability where user-controlled input could be included in HTTP response headers without proper neutralization of CR/LF characters. This may allow an attacker to inject headers or split responses, potentially resulting in unintended behavior or security impact under certain conditions.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Hcltech

Products

Aion

CVE-2026-92196

Quest Foglight for Databases renderTemplateString Server-Side Template Injection Remote Code Execution Vulnerability

Quest Foglight for Databases renderTemplateString Server-Side Template Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Quest Foglight for Databases. Authentication is required to exploit this vulnerability. The specific flaw exists within the renderTemplateString method. The issue results from the lack of proper validation of a user-supplied string before processing it with the template engine. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-29889.

CVSS 3.0 · 7.2 High EPSS < 1% KEV · Not listed

Vendors

Quest

Products

Foglight For Databases

CVE-2026-121818

About Time Technologies｜Herowatch Go - Security Misconfiguration

Herowatch Mini developed by About Time Technologies has a system signing vulnerability. Authenticated local attackers can exploit a publicly available test key to sign malicious programs, allowing them to elevate privileges and execute arbitrary code.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

About Time Technologies

Products

Herowatch Go

CVE-2026-120422

Insecure HTTP configuration retrieval in Sogou Input Method allows arbitrary code execution

Sogou Input Method for Windows contains a vulnerability in the configuration retrieval mechanism of its SGTool.exe component. The application retrieves configuration data over unencrypted HTTP connections, allowing an attacker capable of manipulating network traffic to replace legitimate server responses with malicious configurations. An attacker can exploit this vulnerability to instruct SGTool.exe to download attacker-controlled files to arbitrary locations, including paths used by legitimate application components. This can result in arbitrary code execution when the downloaded files are subsequently executed or loaded by the application.

CVSS 4.0 · 8.9 High EPSS < 1% KEV · Not listed

Vendors

Sogou

Products

Sogou Input Method

CVE-2026-121941

libmt32emu before 2.8.4 Heap Buffer Overflow via MidiStreamParserImpl::parseSysex

libmt32emu before 2.8.4 contains a heap buffer overflow vulnerability in MidiStreamParserImpl::parseSysex that allows attackers to write past a heap allocation by supplying oversized unterminated SysEx messages. Attackers can feed more than 32768 SysEx data bytes through the mt32emu_parse_stream API via MIDI files, ports, or sequencer clients to corrupt heap memory and crash the application.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Munt

Products

Libmt32emu

CVE-2026-121968

Netrek-client-cow through 3.3.3 Out-of-Bounds Read via SP_S_MESSAGE Packets

Netrek-client-cow through 3.3.3 contains an out-of-bounds read vulnerability in short.c handleSMessage() that allows malicious servers to crash clients via an unchecked m_recpt index. Attackers controlling a Netrek server or intercepting the plaintext TCP connection can send SP_S_MESSAGE packets with m_recpt of 36 or more, reading past players[] and shipnos to deny service.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Quozl

Products

Netrek-client-cow

CVE-2026-121969

netrek-client-cow through 3.3.3 Stack Buffer Overflow via handleSMessage

netrek-client-cow through 3.3.3 contains a stack-based buffer overflow vulnerability in handleSMessage() in short.c that allows malicious servers to overflow a 100-byte stack buffer by sending oversized SP_S_MESSAGE packets. A malicious Netrek server or man-in-the-middle on the plaintext TCP connection can send overlong or unterminated message bodies to write server-controlled bytes onto the stack and crash the client.

CVSS 4.0 · 7.1 High EPSS < 1% KEV · Not listed

Vendors

Quozl

Products

Netrek-client-cow

CVE-2026-122130

CESNET ipfixcol2 2.3.0 before 2.9.0 Buffer Overflow via Forwarder Output Plugin

CESNET ipfixcol2 2.3.0 before 2.9.0 contains an integer overflow vulnerability in the Forwarder output plugin that allows unauthenticated IPFIX exporters to overflow a heap buffer by wrapping uint16_t message length counters. Attackers can send near-65535-byte data sets and large templates to a collector forwarding over TCP to crash it and perform 2-byte writes to attacker-influenced addresses.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Cesnet

Products

Ipfixcol2

CVE-2026-123851

HTML-Encoded Prompt Injection Evasion in JetBrains Junie GitHub Action

In JetBrains Junie GitHub Action before 1.6.4 prompt injection protection could be bypassed via HTML-encoded characters

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Jetbrains

Products

Junie Github Action