In SQLite versions before 3.53.2 a high severity vulnerability CVE-2026-11824 was detected. This vulnerability allows an attacker to cause a Denial of Service (crash) or potentially execute arbitrary code. This occurs due to a heap-based buffer overflow in the FTS5 full-text search extension (specifically within the fts5ChunkIterate() function). By supplying a specially crafted database with malicious continuation page metadata (where the szLeaf value is smaller than 4), an attacker can trigger an integer underflow. This results in an inflated remaining byte count during FTS5 MATCH query processing, leading to the overflow of attacker-controlled data into the heap. This vulnerability affects applications compiled with the SQLITE_ENABLE_FTS5 flag. To address this issue, users should upgrade SQLite to version 3.53.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-11824.
In Umbraco CMS versions 14.0.0 to before 17.4.0 a medium severity vulnerability CVE-2026-46609 was detected. This vulnerability allows an authenticated attacker to inject arbitrary HTML or execute malicious JavaScript in the context of another user’s browser (Stored XSS / HTML Injection). This occurs because the Umbraco Backoffice confirmation dialog fails to properly apply output encoding to user-supplied data from an input field before rendering it. If an attacker injects a malicious payload, it will be executed or displayed when an administrator or another user triggers the affected confirmation dialog. To address this issue, users should upgrade Umbraco CMS to version 17.4.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-46609.
Read more CMS
In OneDev versions up to 15.0.5 a medium severity vulnerability CVE-2026-11440 was detected. This vulnerability allows a remote attacker to bypass intended access controls. This occurs due to improper authorization validation when manipulating the project.defaultBranch argument within the REST API endpoint /repositories/{projectId}/default-branch. To address this issue, users should upgrade OneDev to version 15.0.6. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-11440.
In Jenkins versions 2.567 and earlier, and LTS 2.555.2 and earlier a medium severity vulnerability CVE-2026-53439 was detected. This vulnerability allows an attacker with Overall/Read permission to access sensitive user configuration data, leading to information disclosure. This occurs due to missing permission checks, which enable the attacker to determine other users’ configured timezones and enumerate the view names of other users’ “My Views”. To address this issue, users should upgrade Jenkins to a patched version 3.1.4 or later. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-53439.
Read more Developer Tools
In Graphite versions before 1.3.15 a high severity vulnerability CVE-2026-50593 was detected. This vulnerability allows an attacker to cause an out-of-bounds memory write, potentially leading to arbitrary code execution, memory corruption, or a denial of service. This occurs due to an integer underflow in the slotat function, which fails to properly validate that an offset is within the allowed slot-map range when processing Graphite actions. To address this issue, users should upgrade Graphite to version 1.3.15. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-50593.
In Prefect version 3.6.19 a high severity vulnerability CVE-2026-3514 was detected. This vulnerability allows an unauthenticated attacker to bypass authentication and gain unauthorized access to sensitive information, such as API keys and database credentials. This occurs due to the improper handling of URL path exemptions for health check probes. The authentication middleware incorrectly exempts any URL path ending with ‘health’ or ‘ready’ from authentication checks. An attacker can exploit this by creating resources (such as variables, flows, work pools, work queues, and deployments) with names ending in ‘health’ or ‘ready’ to access them without authentication. To address this issue, users should upgrade Prefect to version 3.6.22 or higher. For more details, visit https://avd.aquasec.com/nvd/2026/cve-2026-3514.
Read more Developer Tools
In OneDev versions up to 15.0.5 a medium severity vulnerability CVE-2026-11439 was detected. This vulnerability allows a remote attacker to bypass intended access controls. This occurs due to improper authorization validation when manipulating the project.parentId argument within the Parent Project Handler for the /projects/ functionality. To address this issue, users should upgrade OneDev to version 15.0.6. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-11439.
In LimeSurvey all versions a high severity vulnerability CVE-2026-50635 was detected. This vulnerability allows a remote, unauthenticated attacker to take over a user’s account. This occurs due to a Host Header Injection flaw where LimeSurvey constructs account password-reset links using the unvalidated, client-supplied HTTP Host header (because the allowedHosts allowlist is undefined in the default configuration). By submitting a forgotten-password request with a spoofed Host header, the attacker causes the system to email a reset link pointing to an attacker-controlled server but containing a genuine validation_key. When the victim or an automated email scanner dereferences the link, the token is disclosed to the attacker, who can then use it on the legitimate site to set a new password. To address this issue, users should upgrade LimeSurvey to version version 7.x or the latest 6.x patch release and ensure the allowedHosts parameter is properly configured. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-50635.
In Django versions 5.2 before 5.2.15 and 6.0 before 6.0.6 a low severity vulnerability CVE-2026-35193 was detected. This vulnerability allows remote attackers to read private, authenticated cached responses, leading to sensitive information disclosure. This occurs because the django.middleware.cache.UpdateCacheMiddleware fails to add the Authorization field to the Vary response header for requests bearing that header (unless Cache-Control: public is set). As a result, an unauthenticated request to the same URL can inadvertently be served a cached response meant for a specific authenticated user. To address this issue, users should upgrade Django to versions 5.2.15 or 6.0.6. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-35193.