CVE Vulnerabilities - 14 October 2026

HPE NonStop Java JToolkit can run unauthorized commands

CVE-2026-73792

The HPE NonStop Java JToolkit component can be tricked into executing commands it shouldn't, and it may also overflow memory, which could let an attacker take control of the system. This could lead to...

3.8

FileRise preview endpoint can be accessed without login

CVE-2026-64856 GHSA-p4c7-8jm2-m88q

Versions of FileRise earlier than 3.20.0 let anyone call the /api/file/snippet.php preview service without first proving they are logged in. While the system still checks file permissions, an attacker...

3.7

CGA-hw6j-2cvm-gprm

CGA-hw6j-2cvm-gprm

3.7

CGA-5xhp-wff7-x4gf

CGA-5xhp-wff7-x4gf

3.7

CGA-jv56-25w3-53qc

CGA-jv56-25w3-53qc

3.7

CGA-cpxc-jwfp-wh69

CGA-cpxc-jwfp-wh69

3.7

CGA-mh82-27vc-hfgp

CGA-mh82-27vc-hfgp

3.7

CGA-hw74-ghgg-v37w

CGA-hw74-ghgg-v37w

3.7

CGA-pwhm-j2q9-cq6m

CGA-pwhm-j2q9-cq6m

3.7

cpp-httplib library can let attackers alter HTTP request line

CVE-2026-103930 GHSA-vq69-f637-8fhr UBUNTU-CVE-2026-103930 DEBIAN-CVE-2026-103930

Versions of the cpp-httplib C++ library from 0.29.0 to 0.51.0 let specially crafted input break the HTTP request line, allowing an attacker to change request details that reach your server. This can h...

3.7

CGA-hh25-cpj7-f2wq

CGA-hh25-cpj7-f2wq

3.7

CGA-5gv4-9994-2hjx

CGA-5gv4-9994-2hjx

3.7

CGA-mh6w-3h5w-w73c

CGA-mh6w-3h5w-w73c

3.7

CGA-76xw-p9wr-pfm6

CGA-76xw-p9wr-pfm6

3.7

CGA-m252-v3wg-rqph

CGA-m252-v3wg-rqph

3.7

Zimbra Collaboration Suite allows unlimited password guessing

CVE-2026-93637

Versions 10.1.0 through 10.1.21 of Zimbra Collaboration Suite let an unauthenticated attacker submit many password attempts without triggering the usual lock‑out counter. This means brute‑force attack...

3.7

rustls Brotli feature can cause 1 GB memory allocation

RUSTSEC-2026-0348 GHSA-h2v8-394m-p7vv

If you enable the Brotli option in rustls, a malicious server or client can trigger a request for up to 1 GB of memory during certificate handling. This can cause the process to run out of memory and ...

3.7

rustls clients may lose post‑quantum protection after downgrade

RUSTSEC-2026-0349 GHSA-w44r-93j7-qv28

Clients that use the rustls library can be tricked into remembering a weaker encryption method after a brief failed connection. A network attacker can then cause later connections to use only the olde...

3.7

UniFi Protect AI Key lets attackers alter device files

CVE-2026-110458

The UniFi Protect AI Key can be tricked by someone on the same network into creating or deleting files on the device. This could let a malicious user change settings or disrupt service. Apply the late...

3.7

UniFi Protect AI Key may reveal device files

CVE-2026-110457

If someone can reach the UniFi Protect AI Key on your network, they could trick it into showing the list of files stored on the device. This could expose sensitive information or help an attacker plan...

3.7

joi package may be exploited until updated

CVE-2026-84367 GHSA-gg4h-3hg2-grpc ROOT-APP-NPM-CVE-2026-84367

The Joi validation library used in Node.js applications had a security weakness that could let an attacker interfere with your software. Updated versions of joi (including the hapijs/joi and @rootio/j...

3.7

OpenJDK 11 and 17 may allow network data leak

CLEANSTART-2026-YR57820

The networking part of OpenJDK versions 11 and 17 can be tricked into revealing information it shouldn't. This could let an attacker see data that is being sent or received over the network. Apply the...

3.7

OpenJDK 11 and 17 libraries may let attackers run code

CLEANSTART-2026-ZN44183

The library components in OpenJDK 11 and OpenJDK 17 builds from CleanStart contain a flaw that could allow an attacker to execute arbitrary code on a vulnerable system. This can lead to unauthorized a...

3.7

OpenJDK 11, 17, 21 can be tricked into running code

CLEANSTART-2026-YP18578

The OpenJDK versions 11, 17, and 21 have a flaw in the Hotspot component that could let an attacker execute unauthorized code. This could affect any application that runs on these Java runtimes. Updat...

3.7

Gitea notebook view can be tricked to hide clicks

CVE-2026-60008 GHSA-7452-653r-6gp8

When Gitea shows Jupyter notebooks, it adds information from the notebook into a style tag without cleaning it. A crafted notebook can insert extra style classes that create an invisible layer over th...

3.5