CVE-2026-111335

Improper request handling can lead to a denial-of-service / reboot-loop condition in Citrix NetScaler ADC and Citrix NetScaler Gateway

Improper request handling can lead to a denial-of-service / reboot-loop condition in Citrix NetScaler ADC and Citrix NetScaler Gateway.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Citrix

Products

Gateway Netscaler Adc Netscaler Gateway

CVE-2026-111336

Memory overflow in HTTP/2 handling can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway

Memory overflow in HTTP/2 handling can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.

CVSS 4.0 · 8.3 High EPSS < 1% KEV · Not listed

Vendors

Citrix

Products

Gateway Netscaler Adc Netscaler Gateway

CVE-2026-111337

Memory overflow in Base64 decoding in advanced policy expressions leading to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway

Memory overflow in Base64 decoding in advanced policy expressions leading to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Citrix

Products

Gateway Netscaler Adc Netscaler Gateway

CVE-2026-111338

Sensitive authentication material written to a log file in Citrix NetScaler ADC and Citrix NetScaler Gateway

Sensitive authentication material written to a log file in Citrix NetScaler ADC and Citrix NetScaler Gateway.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Citrix

Products

Gateway Netscaler Adc Netscaler Gateway

CVE-2026-111339

Memory overflow in Application Firewall data decompression/inspection can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway

Memory overflow in Application Firewall data decompression/inspection can lead to unpredictable or erroneous behavior or Denial of Service in Citrix NetScaler ADC and Citrix NetScaler Gateway.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Citrix

Products

Gateway Netscaler Adc Netscaler Gateway

CVE-2026-107524

Integer Overflow in Dell PowerStore Allows Authenticated Host to Cause Out‑of‑Bounds Data Access or Denial of Service

Dell PowerStore contains an integer overflow vulnerability. An authenticated storage host could exploit this vulnerability, potentially leading to out-of-bounds data access or denial of service.

CVSS 3.1 · 8.8 High EPSS n/a KEV · Not listed

Vendors

Dell

Products

Powerstore 1000t Powerstore 1200t Powerstore 3000t and 9 more

CVE-2026-111547

Out‑of‑Bounds Read Vulnerability in Dell PowerStore Systems

Dell PowerStore contains an out-of-bounds read vulnerability. An attacker could exploit this vulnerability, potentially leading to denial of service or limited information disclosure.

CVSS 3.1 · 8.1 High EPSS n/a KEV · Not listed

Vendors

Dell

Products

Powerstore 1000t Powerstore 1200t Powerstore 3000t and 9 more

CVE-2026-107523

Integer Overflow in Dell PowerStore Enables Volume Bounds Check Bypass

Dell PowerStore contains an integer overflow vulnerability. An adjacent attacker could exploit it to bypass volume bounds checks, potentially leading to data destruction or denial of service.

CVSS 3.1 · 8.7 High EPSS n/a KEV · Not listed

Vendors

Dell

Products

Powerstore 1000t Powerstore 1200t Powerstore 3000t and 9 more

CVE-2026-107522

Dell PowerStore Improper Authorization Leading to Privilege Escalation

Dell PowerStore contains an Improper Authorization vulnerability. An authenticated user could exploit this vulnerability, potentially leading to privilege escalation to administrator.

CVSS 3.1 · 7.2 High EPSS n/a KEV · Not listed

Vendors

Dell

Products

Powerstore 1000t Powerstore 1200t Powerstore 3000t and 9 more

CVE-2026-111545

SQL Injection Leading to Private Key Disclosure in Dell PowerStore Appliances

Dell PowerStore contains a SQL Injection vulnerability. An authenticated attacker could exploit this vulnerability, potentially leading to disclosure of stored private keys and tampering with trusted certificates.

CVSS 3.1 · 8.8 High EPSS n/a KEV · Not listed

Vendors

Dell

Products

Powerstore 1000t Powerstore 1200t Powerstore 3000t and 9 more

CVE-2026-126364

Astro: Image endpoint in @astrojs/node can read files from a case-variant sibling of the output directory on case-sensitive filesystems

Astro is a web framework for content-driven websites. From 5.14.3 until 7.4.7, Astro's /_image endpoint compared the requested local-image path with the build output directory without preserving case on case-sensitive filesystems. A sibling directory whose path differed from the output directory only by letter case could therefore pass the containment check, allowing an unauthenticated requester to read image files accepted by the image service from outside the output directory. Exploitation required on-demand rendering with the @astrojs/node adapter, a case-sensitive filesystem, and a preexisting case-variant sibling directory; ordinary traversal to unrelated paths was already rejected. This issue is fixed in Astro version 7.4.7.

CVSS 4.0 · 6.3 Medium EPSS < 1% KEV · Not listed

Vendors

Astro Withastro

Products

Astro Astro

CVE-2026-126367

@grpc/grpc-js: safe_regex incorrectly applies partial string matching for patterns with alternation

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Before 1.13.2, and from 1.14.0 through 1.14.1, the @grpc/grpc-js-xds SafeRegexValueMatcher and PathSafeRegexValueMatcher add start and end anchors without grouping a supplied top-level alternation. An expression intended to match one of several complete values can therefore match a prefix, substring, or suffix. The affected matchers are used for route selection, xDS credential identity matching, and RBAC URL path, principal name, server name, and header rules. An ALLOW policy using an alternation can consequently accept a method, certificate identity, or header value outside the intended set, while a DENY policy becomes broader rather than permissive. This issue is fixed in versions 1.13.2 and 1.14.2.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Grpc

Products

Grpc-node

CVE-2026-128065

@grpc/grpc-js: RBAC override configs in VirtualHost and Route resources are not applied

@grpc/grpc-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. From 1.14.0 through 1.14.1, XdsServer in @grpc/grpc-js-xds can acknowledge Route and VirtualHost resources while failing to apply their RBACPerRoute override configurations. The override parser is not registered under the override message type, override maps are stored under a type URL instead of the configured HTTP filter name, and VirtualHost override maps are not read. When experimental RBAC is enabled and a trusted xDS control plane supplies a broad top-level ALLOW policy with a stricter matching override, affected servers evaluate RPCs under the broad policy and can accept requests that should be denied. This issue is fixed in version 1.14.2.

CVSS 4.0 · 6.9 Medium EPSS < 1% KEV · Not listed

Vendors

Grpc

Products

Grpc-node

CVE-2026-124664

Mine CloudVod < 2.6.7 - Unauthenticated Paid Lesson Content Disclosure

The Mine CloudVod WordPress plugin before 2.6.7 does not check whether the requester is enrolled in a course, or authorised at all, before returning the course's full curriculum together with the raw content of every published lesson, allowing unauthenticated visitors to retrieve paid lesson content, such as direct video source URLs, and the passwords of password-protected lessons.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Wordpress-extensions

Products

Mine Cloudvod

CVE-2026-97041

Host linker flag injection via //go:cgo_* directives in cmd/compile and cmd/link

Building a malicious package containing "//go:cgo_*" compiler directives could inject arbitrary flags into the external linker invocation on ELF platforms. The compiler and linker did not reject commas in "//go:cgo_import_dynamic", "//go:cgo_export_dynamic", "//go:cgo_export_static", "//go:cgo_import_static", and "//go:cgo_dynamic_linker" directives, and the linker passed the dynamic linker path using "-Wl,--dynamic-linker,<path>". Furthermore, the two-argument form of "//go:cgo_import_dynamic" (which is permitted in non-cgo Go source files) could overwrite the external symbol name of a symbol already marked for cgo export. A symbol name or dynamic linker path containing a comma or leading "@" could split "-Wl,--export-dynamic-symbol=" or "-Wl,--dynamic-linker," into arbitrary host linker flags or response file arguments. The compiler and linker now reject commas in "//go:cgo_*" symbol and dynamic linker directives, the linker passes "-Wl,--dynamic-linker=<path>", and "cgo_import_dynamic" no longer overwrites symbols exported via "cgo_export_dynamic" or "cgo_export_static".

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-97038

Arbitrary code execution via crafted .syso files and cgo linker input files in cmd/go

Building a malicious package containing ".syso" files or cgo linker inputs could inject arbitrary linker flags or execute arbitrary code at link time. Linker input files—including ".syso" files, direct object or library inputs in "#cgo LDFLAGS", and libraries in "-L" directories—were passed to the external linker without validating their format or checking for embedded linker options. Across platforms, this allowed executing GNU ld implicit linker scripts disguised as libraries or ".syso" files (or loaded via "-l:<filename>" or "-l" containing path separators), injecting unallowlisted linker flags via PE/COFF ".drectve" sections on Windows or Mach-O "LC_LINKER_OPTION" load commands on Darwin, or invoking LTO plugins via GCC or LLVM LTO intermediate representation sections in ELF, PE/COFF, or Mach-O objects. The go command now verifies that ".syso" files, direct linker inputs, and libraries in "-L" directories are valid binary objects or archives that do not contain unallowlisted ".drectve" directives, "LC_LINKER_OPTION" load commands, or LTO IR sections, and disallows "-l:<filename>" and ":", "=", or path separators in "-l" flags.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2026-97033

Unexpected code execution via --sysroot, -target, -isysroot, -Wl,-syslibroot, and -x cgo flags in cmd/go

Building a malicious package that uses cgo could cause arbitrary code execution at build time through several compiler and linker flags permitted in "#cgo" directives. Specifically, "--sysroot" in GCC and Clang relocates compiler subprograms, spec files, and CRT startup objects to an attacker-controlled directory; "-target" in Clang falls back to executing target helper tools from the current working directory when not found in PATH; "-isysroot" and "-Wl,-syslibroot" can pass a regular file on disk to GNU ld.bfd, which interprets it as a positional linker script; and "-x" permitted specifying arbitrary compiler input languages beyond those supported by cgo. "--sysroot" and "-target" are now disallowed in "#cgo" flags, "-isysroot" and "-Wl,-syslibroot" are verified not to point to regular files, and "-x" is restricted to the C, C++, Objective-C, and assembler languages supported by cgo.

CVSS n/a EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2025-53700

Insecure Storage of Sensitive Information in Johnson Controls iSTAR Ultra Series

CWE‑922 Insecure Storage of Sensitive Information vulnerability in Johnson Controls iSTAR Ultra, Johnson Controls iSTAR Ultra SE, Johnson Controls iSTAR Ultra G2, Johnson Controls iSTAR Ultra G2 SE, and Johnson Controls iSTAR Edge G2 allows CAPEC‑15 File Manipulation. This issue affects iSTAR Ultra: before 6.9.2.CU02; iSTAR Ultra SE: before 6.9.2.CU02; iSTAR Ultra G2: before 6.9.2.CU02; iSTAR Ultra G2 SE: before 6.9.2.CU02; iSTAR Edge G2: before 6.9.2.CU02.

CVSS 4.0 · 6.3 Medium EPSS n/a KEV · Not listed

Vendors

Johnson Controls Johnsoncontrols

Products

Istar Edge G2 Istar Ultra Istar Ultra G2 and 7 more

CVE-2026-128067

Pillow: Heap buffer overflow saving TIFF with libtiff when tags override image size

Pillow is a Python imaging library. From 2.3.0 through 12.3.0, Pillow applications that save compressed TIFF images through libtiff can pass attacker-controlled image geometry tags to the encoder while allocating its row buffer from the actual image dimensions. The affected TiffImagePlugin._save path allows ImageWidth, ImageLength, or SamplesPerPixel from exif=, tiffinfo=, or a source TIFF IFD to make libtiff consume a larger scanline than the buffer supplied by ImagingLibTiffEncode. This can read heap memory into the generated TIFF or crash the process. When TIFF Predictor 2 is enabled, libtiff can rewrite the oversized scanline in place and corrupt memory beyond the buffer. A carried-over PlanarConfiguration value of 2 instead makes libtiff use a shorter scanline and can produce an undecodable output file, but is not established to cause the out-of-bounds access. This issue is fixed in version 13.0.0.

CVSS 4.0 · 8.4 High EPSS < 1% KEV · Not listed

Vendors

Python-pillow

Products

Pillow

CVE-2026-126839

Deserialization allow-list bypass via anonymous-type misdetection in BSON object deserialization

A deserialization type-restriction control in the BSON serialization component can be bypassed because the check used to recognize a class of compiler-generated types relies on an overly permissive heuristic rather than a precise identification. An unauthorized party able to supply BSON content that an application later deserializes into a loosely typed member can cause types outside the intended allow-list to be constructed and populated with unauthorized party-supplied values inside the consuming application. This can lead to unexpected object state and errors in downstream application logic. No elevated privileges beyond the ability to place unauthorized party-influenced content in the deserialization path are required.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed

Vendors

Mongodb

Products

C# Driver