CVE Vulnerabilities - 29 September 2026

LibTIFF can cause local crash via memory error

CVE-2025-8176 ROOT-OS-DEBIAN-11-CVE-2025-8176 ROOT-OS-DEBIAN-12-CVE-2025-8176 DEBIAN-CVE-2025-8176

The LibTIFF library used in several Linux distributions may mishandle image data, causing the program to access memory that has already been released. This can lead to a crash or unexpected behavior o...

1.9

MODSetter SurfSense allows attackers to run commands remotely

CVE-2026-102243

The test feature in MODSetter SurfSense up to version 2.0.3 can be tricked into executing arbitrary commands on the server. An attacker who can reach the web address /api/search-source/connectors/mcp/...

2.1

Camaleon CMS media cropping can be accessed without permission

CVE-2026-102261

The media‑crop feature in Camaleon CMS versions up to 2.9.2 lets anyone change images without proper login checks. This could allow remote attackers to replace or modify stored pictures. Upgrade to ve...

2.1

RaspAP web GUI allows remote command execution

CVE-2026-101859

The RaspAP web interface (raspap-webgui) up to version 3.5.5 lets an attacker send specially crafted data to a configuration page and run commands on the underlying system. This can be done over the n...

2.1

Naichen ThinkCMF email templates can be tampered remotely

CVE-2026-102771

The MailController component in Naichen ThinkCMF versions up to 8.0.7 does not properly clean special characters in email templates. This lets an attacker send a crafted request over the network and a...

2.0

UnoPim admin pages may load malicious scripts

CVE-2026-102630

Versions of UnoPim prior to 2.0.1 and 2.1.1 accept any X-Forwarded-Host header, letting an unauthenticated attacker tell the system to load JavaScript from their own server. If a shared cache stores t...

2.3

Robo‑Cafe RMS allows remote file upload

CVE-2026-102263

The manage-food.php page in the Robo‑Cafe RMS system lets anyone upload files without checks, and this can be done from anywhere on the internet. An attacker could place malicious files on the server,...

2.0

RaspAP web interface allows remote command execution via Wi‑Fi name

CVE-2026-101858

The RaspAP web GUI (up to version 3.5.5) lets an attacker supply a specially crafted Wi‑Fi network name that runs operating‑system commands on the device. This can be triggered from a remote location ...

2.0

Fider can be tricked to contact internal services

CVE-2026-102877 GHSA-whx4-hxwq-qgjh

If you run Fider version earlier than 0.38.0, an attacker who can control DNS could make the Fider server send requests to your internal systems or cloud metadata services when it processes webhooks o...

2.1

Mall4j up to 4.0 lets attackers upload malicious files

CVE-2026-102366

The Mall4j shopping platform (versions up to 4.0) lets anyone with a logged‑in account upload files through its admin panel without checking the file type or the user's rights. An attacker could place...

2.1

coolbeans1212 MateisHomePage-Website users.php lets attackers inject code

CVE-2026-102292

The users.php page of the coolbeans1212 MateisHomePage-Website can be tricked into running malicious code when a specially crafted search term is supplied. This can allow a remote attacker to display ...

2.1

MODSetter SurfSense Document Export allows remote request hijack

CVE-2026-102244

The document export function in MODSetter SurfSense (versions up to 0.0.36) can be tricked into sending internal network requests to locations chosen by an attacker. This could let an attacker make th...

2.1

Toptech TMS7 and TopHAT allow code injection

CVE-2026-69662

The Toptech TMS7 and TopHAT applications can run code that an attacker inserts into the system. This could let a malicious user execute unwanted commands or steal data. Update the software or apply th...

2.1

Russh library allows unlimited login attempts

CVE-2026-102825 GHSA-g6xm-f9xp-qq35 UBUNTU-CVE-2026-102825

Versions of the Russh SSH library before 0.62.6 do not stop a remote client from sending more authentication attempts than the configured limit. This lets an attacker keep guessing passwords on a sing...

3.7

russh library can crash when mac=none is allowed

CVE-2026-102822 GHSA-p8qx-h547-fjw9 UBUNTU-CVE-2026-102822

The Russh SSH client and server library (versions before 0.63.1) may let a connection request that disables message authentication (mac=none) combine with certain encryption modes, leading to a progra...

3.7

GitLab may let strangers view job logs

CVE-2026-4523 BIT-gitlab-2026-4523

GitLab versions from 15.11 up to certain recent releases could let anyone without an account see the detailed output of CI/CD jobs, which may include secret values. This exposure happens because the s...

3.7

OpenSSL SM2 signing can leak private key

CVE-2026-77696 DEBIAN-CVE-2026-77696 UBUNTU-CVE-2026-77696 ALPINE-CVE-2026-77696

When OpenSSL creates an SM2 digital signature, the time it takes can vary depending on secret numbers used in the process. An attacker who can measure these timings across many signatures could eventu...

3.7

OpenSSL server can be used to amplify DDoS attacks

CVE-2026-35191 DEBIAN-CVE-2026-35191 UBUNTU-CVE-2026-35191 BELL-CVE-2026-35191

When OpenSSL’s QUIC server is set to skip address checks, it can mistakenly count incoming data multiple times, allowing an attacker to send small spoofed packets and cause the server to reply with mu...

3.7

OpenSSL on ARM64/RISC-V can leak private keys

CVE-2026-54875 DEBIAN-CVE-2026-54875 UBUNTU-CVE-2026-54875 ALPINE-CVE-2026-54875

OpenSSL versions 4.0, 3.6, 3.5 and 3.4 running on ARM64 or RISC‑V processors use a special calculation that takes slightly different amounts of time depending on the secret key. An attacker who can wa...

3.7

OpenSSL signing may expose private keys through timing

CVE-2026-54872 DEBIAN-CVE-2026-54872 UBUNTU-CVE-2026-54872 ALPINE-CVE-2026-54872

The generic signing routine in OpenSSL (including the Debian, Canonical and Node.js builds) leaks tiny timing differences when using certain non‑standard curves such as Brainpool. An attacker who can ...

3.7

Flysystem library can hide malicious filenames

CVE-2026-102601 GHSA-cxf4-7mrp-vvpr UBUNTU-CVE-2026-102601 DEBIAN-CVE-2026-102601

The PHP Flysystem file‑storage library before version 3.35.3 could be tricked into accepting specially crafted file names that contain broken UTF‑8 characters. These names can contain hidden control c...

3.5

Rocket LMS allows malicious code through student photo upload

CVE-2026-102290

The Rocket LMS system lets users upload a picture for a student profile. If an attacker tricks the system, they can insert harmful code that runs when others view the profile, potentially stealing dat...

2.0

Robo‑Cafe RMS edit profile allows malicious script injection

CVE-2026-102264

The edit‑profile page in Robo‑Cafe RMS can let an attacker insert harmful code by changing the Name, Address or City fields. This could let a remote user run scripts in the browsers of anyone who view...

2.0

Chrome before 154.0.8037.92 lets attackers read hidden memory

CVE-2026-102319

Versions of Google Chrome older than 154.0.8037.92 contain a flaw in the graphics component that can expose memory contents when a malicious web page is displayed. If an attacker has already gained li...

3.4

Google Chrome on Windows may leak memory to attackers

CVE-2026-102315

Versions of Google Chrome for Windows before 154.0.8037.92 can expose memory contents if a malicious web page tricks a compromised part of the browser. This could let an attacker see data from other p...

3.4