CVE-2026-0004

Transient Execution Vulnerability Leading to Cache‑Based Data Leakage

A transient execution vulnerability in some AMD processors may allow an attacker with the ability to execute code on the system to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries.

CVSS 4.0 · 5.7 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-126356

Hono: `validator('form')` skips validation for `multipart/form-data` requests with extra parameters

Hono is a Web application framework that provides support for any JavaScript runtime. From 4.5.1 until 4.13.16, validator('form') uses a strict whole-header pattern that fails to recognize multipart/form-data when its Content-Type includes another legal parameter or extra whitespace after a semicolon. The validation callback receives an empty object even though c.req.parseBody() or c.req.formData() can still parse and expose all submitted fields to the handler. An unauthenticated client can therefore bypass allow-list or required-field checks when the application relies on the form validator and its callback accepts an empty object. application/x-www-form-urlencoded requests are not affected. This issue is fixed in version 4.13.16.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-123292

Persisting API Tokens and Sessions for Removed or Banned Users in JetBrains Datalore

In JetBrains Datalore before 2026.4 aPI tokens and sessions of removed or banned users remained valid

CVSS 3.1 · 2.7 Low EPSS < 1% KEV · Not listed

Vendors

Jetbrains

Products

Datalore

CVE-2024-36357

kernel: transient execution vulnerability in some AMD processors

A transient execution vulnerability in some AMD processors may allow an attacker to infer data in the L1D cache, potentially resulting in the leakage of sensitive information across privileged boundaries.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2024-36350

kernel: information leak via transient execution vulnerability in some AMD processors

A transient execution vulnerability in some AMD processors may allow an attacker to infer data from previous stores, potentially resulting in the leakage of privileged information.

CVSS 3.1 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-126767

OpsTree REMS through 1.0.0 Prompt Injection via RCA Chat Assistant

OpsTree REMS through 1.0.0 contains a prompt injection vulnerability that allows authenticated users to disclose the hidden system prompt by submitting crafted chat input to POST /api/v1/rca/chat. Attackers can instruct the assistant to ignore its rules and reveal internal orchestration instructions, aiding the crafting of further prompt injection attacks.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-73451

On affected platforms running Arista EOS with dual switch cards and with ingress Security ACLs configured on Switched Virtual Interfaces (SVI) in shared mode, restarting of the secondary switchcard forwarding agent or insertion of secondary switchcard, can

On affected platforms running Arista EOS with dual switch cards and with ingress Security ACLs configured on Switched Virtual Interfaces (SVI) in shared mode, restarting of the secondary switchcard forwarding agent or insertion of secondary switchcard, can cause security ACLs on shared SVIs to stop functioning. This may result in incorrect packet permit/deny behavior. This issue was discovered internally by Arista, and the company is not aware of any malicious exploitation of this vulnerability in customer networks.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Arista

Products

Eos

CVE-2026-123283

SSO-Based Account Takeover in JetBrains Datalore Prior to 2026.4

In JetBrains Datalore before 2026.4 account takeover was possible via SSO sign-in to a pre-registered account

CVSS 3.1 · 6.8 Medium EPSS < 1% KEV · Not listed

Vendors

Jetbrains

Products

Datalore

CVE-2026-18448

Leak SMM RAM from the kernel (Simply TSA after an SMI)

EDK2 contains a vulnerability in BIOS where a privileged attacker may cause “Exposure of Sensitive Information during Transient Execution” by local access. Successful exploitation of this vulnerability may result in disclosure of SMRAM contents. It could also impact Confidentiality.

CVSS 4.0 · 5.6 Medium EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-120997

Improper session invalidation keeps removed or demoted members' open pages and device consoles working at their old role

Improper Session Invalidation vulnerability in the dashboard pages, device console and local shell channels in nerves-hub nerves_hub_web allows an organization member who is removed or given a lower role to keep acting at their old role through anything they had open at the time. The dashboard reads the member's role once when a page mounts, in the assign_org_to_scope hook of NervesHubWeb.Auth, and the console, local shell and device event stream channels check membership once at join. Removing a member or changing their role tells none of them, so open pages keep carrying out actions and open consoles keep running commands on the device until the page reloads or the socket disconnects. The dashboard also opens consoles over NervesHubWeb.UserSocket with a token that holds only the user's id, is accepted for 24 hours, and is not revoked by signing out, which disconnects only the session's LiveViews. Whoever holds a token taken from a page can open consoles as that user, within the user's current membership, until it expires. This issue affects nerves_hub: from 1.0.0 before 2.5.3.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Nerves-hub

Products

Nerves Hub Web

CVE-2026-123653

esengine DeepSeek-Reasonix doc.go discoverDocs llm prompting input

A security vulnerability has been detected in esengine DeepSeek-Reasonix up to 2.52.0. Affected is the function discoverDocs of the file internal/memory/doc.go. The manipulation leads to improper neutralization of input used for llm prompting. The attack can be initiated remotely. The exploit has been disclosed publicly and may be used. Upgrading to version 2.53.0 is able to address this issue. The identifier of the patch is 4ca33493a673c2788aa8598fbca2b2f47a69e1b8. It is suggested to upgrade the affected component.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Esengine

Products

Deepseek-reasonix

CVE-2026-106020

LLM Prompting Input Neutralization Failure Leading to Search Order Hijacking

Improper neutralization of input used for LLM prompting vulnerability in Johnson Controls EasyIO Neo IO Manager and Tools Installer allows Search Order Hijacking. This issue affects EasyIO Neo IO Manager and Tools Installer: 1.1.0.0.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Johnsoncontrols

Products

Easyio Neo Io Manager And Tools Installer

CVE-2026-120647

CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename

CGI versions before 5.00 for Perl allow Content-Disposition parameter injection via unescaped double quotes in the header attachment filename. header(-attachment => $name) writes $name into the quoted filename parameter of Content-Disposition without escaping double quotes. An application that passes request data as the attachment name can be made to send a second filename parameter, changing the name the response is saved under.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-120644

CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values

CGI::Cookie versions before 5.00 for Perl allow cookie attribute injection via unvalidated path, domain and expires values. The path, domain and expires values are written into the Set-Cookie header without checking for semicolons or control characters. An application that sets them from request data can be made to add other cookie attributes, such as Domain or SameSite.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-54140

OpenHuman: MCP tool description injection: untrusted server descriptions execute in agent LLM context without sanitization

OpenHuman is an open-source agent harness available as a desktop application and Rust library. Before 0.57.13, OpenHuman places names, descriptions, titles, and parameter definitions returned by configured external MCP servers into the agent model context without neutralizing instructions or bounding the descriptive fields. The McpRemoteTool records produced by list_tools preserve this remote content, while tool filtering considers the tool name and the prompt-injection detector screens user messages rather than MCP definitions. A malicious or compromised MCP server can therefore return a poisoned description that is evaluated on every agent turn and may direct the model to invoke other available tools, disclose accessible data, or perform unauthorized actions without a separate malicious user message. The issue affects users who configure an attacker-controlled or compromised MCP server. This issue is fixed in version 0.57.13.

CVSS 3.1 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Tinyhumansai

Products

Openhuman

CVE-2026-124028

mistral.rs before 0.9.5 Tool Call Injection via mistralrs-core Output Parsers

mistral.rs before 0.9.5 contains a delimiter injection vulnerability in mistralrs-core that allows attackers to inject tool calls by placing delimiter strings in text the model quotes. Attackers controlling documents, web pages or tool outputs can embed tags like </tool_call> to make qwen-xml, gemma4 or reasoning parsers return extra calls to declared tools with attacker-chosen arguments.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Ericlbuehler

Products

Mistral.rs

CVE-2026-123498

Vikunja veans before 2.7.1 Prompt Injection via Project and Task Metadata

Vikunja veans before 2.7.1 contains a prompt injection vulnerability that allows project members with write access to inject instructions by setting project titles or task content rendered verbatim inside the coding agent's authoritative instruction block. Attackers can craft ProjectTitle or task descriptions that the prime hook loads on SessionStart and PreCompact, causing the agent to modify the developer's checkout or run commands.

CVSS 4.0 · 2.1 Low EPSS < 1% KEV · Not listed

Vendors

Vikunja

Products

Vikunja

CVE-2026-102344

Lavish: DNS rebinding allows any website to read arbitrary local files and inject prompts into the AI agent via the unauthenticated local server

Lavish is the new editor for your HTML artifacts. Prior to 0.1.43, the lavish-axi loopback HTTP server did not authenticate requests or validate Host and Origin values on session, artifact, prompt, and polling routes. A website visited while the server is running can use DNS rebinding to send same-origin browser requests to the local service. POST /api/sessions accepts a caller-selected file path and returns its deterministic session key; GET /artifact/:key/index.html then returns the file contents, allowing disclosure of any file readable by the server process without an existing session. An attacker can also queue text through POST /api/:key/prompts for an active agent session when the artifact path is known or guessed. Visiting the attacker-controlled website is the required user interaction. This vulnerability is fixed in 0.1.43.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Kunchenguid

Products

Lavish-axi

CVE-2026-107181

Telegram Desktop before 7.2.9 IPC Record Injection File Exfiltration via interpret: Scheme

Telegram Desktop before 7.2.9 contains an IPC record-separator injection vulnerability in Core::Sandbox that allows remote attackers to inject OPEN: records via crafted tg:// links containing unescaped semicolons. Attackers can reach the interpret: scheme handler to upload local files, including tdata session keys, to an attacker channel, enabling account takeover.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Telegram

Products

Telegram Desktop

CVE-2026-114713

unrealircd: unrealircd: Command injection via unescaped message tag

The labeled-response module in UnrealIRCd 6.0.0 before 6.2.7.1 does not escape the IRCv3 "label" message tag when echoing it into replies, which allows any user on a network with two or more linked servers to inject server-to-server commands that are executed with server authority.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Unrealircd

Products

Unrealircd