Analysis

Ocelot through 24.1.0 contains an access control bypass that lets clients denied by IP-based rules reach downstream services by sending WebSocket upgrade requests. The record ties the issue to a MapWhen branch that omits SecurityMiddleware and cites fix commit f156fd4. No confirmed exploitation appears in the sources consulted.

IBM WebSphere Application Server Liberty contains a server-side request forgery flaw when the apiDiscovery-1.0 feature is enabled. NVD rates it critical with a CVSS 3.1 base score of 9.8, while IBM PSIRT lists 8.5. The record shows no CISA KEV listing and no confirmed exploitation in the sources consulted.

Gorse versions before 0.5.10 expose the /api/dump and /api/restore endpoints without authentication when admin_api_key is empty, which is the default configuration. An unauthenticated remote attacker could read the full database, including user records and feedback containing personal data, or overwrite the dataset. The record rates it critical with CVSS 3.1 score 9.8, and no confirmed exploitation appears in the sources consulted.

CVE-2026-58449 affects txtai through 9.10.0, where the /reindex API endpoint resolves a caller-supplied dotted path without an allowlist. Under the stated conditions (API exposed, no TOKEN configured, writable index), the record describes remote code execution as the server process; the record indicates the fix is commit 11b32da, which gates the endpoint behind a new reindex configuration flag.

CVE-2026-42864 affects the FireFighter incident management application before 0.0.54. A Jira bot endpoint accepts requests without authentication and fetches caller-supplied URLs from the server, which can expose temporary cloud credentials on some AWS deployments. The record states the issue is fixed in 0.0.54 and reports a critical CVSS 3.1 score of 9.9.

CVE-2026-0685 is a server side template injection flaw in the expression evaluation component of Genshi Template Engine 0.7.9. According to the record, crafted template expressions allow a remote attacker to achieve remote code execution. The record carries a CVSS 3.1 base score of 9.8 (Critical) but lists no affected version ranges or fixed versions, and no confirmed exploitation appears in the sources consulted.

Mozilla disclosed memory safety bugs in Firefox 152.0.3, some showing signs of memory corruption. The record states they were fixed in Firefox 152.0.4, and NVD assigns a CVSS 3.1 base score of 9.8 with CWE-787. Administrators should confirm that all installations run the fixed release.

Versions of @fastify/express up to 4.0.6 fail to apply the plugin prefix to middleware mount paths given as arrays or regular expressions. Middleware scoped to routes inside prefixed plugins can therefore be skipped, which the record describes as a bypass of authentication, authorization, rate limiting or auditing controls. The record points to version 4.0.7 as the patched release and no confirmed exploitation appears in the sources consulted.

CVE-2026-56030 is recorded as an unauthenticated privilege escalation issue (CWE-266) in Paytium versions up to and including 5.0.2. The CNA score is CVSS 3.1 9.8 (Critical), and the record lists no fixed version. No confirmed exploitation appears in the sources consulted.

CVE-2026-57658 describes an administrator-level arbitrary file upload flaw in TemplateSpare versions up to and including 4.2.0, reported by Patchstack and classified as CWE-434. The CNA assigned a CVSS 3.1 base score of 9.1 (critical). The record shows no CISA KEV listing and no confirmed exploitation in the sources consulted, and it provides no structured fixed version.

IBM published CVE-2026-11541 on 2026-06-30 for an HTTP request smuggling flaw (CWE-444) affecting IBM WebSphere Application Server and WebSphere Application Server Liberty. NVD rates it 9.8 Critical under CVSS 3.1, while IBM's own CVSS 3.1 score in the record is 7.4. The record does not list fixed versions, and no confirmed exploitation appears in the sources consulted.

A DCMTK client using bit-preserving C-GET storage mode can be induced by a malicious or compromised server to write files outside the chosen output directory. The weakness is classified as CWE-22 (Path Traversal) and is scored 9.8 under CVSS 3.1 and 9.3 under CVSS 4.0 by the CNA. No confirmed exploitation appears in the sources consulted, and the record lists no affected or fixed versions.

A critical flaw in the Object Query Language engine of IBM WebSphere Extreme Scale 8.6.1.0 through 8.6.1.6 allows externally influenced class names to be instantiated without an allow-list. NVD scores it 9.9 (CVSS 3.1), while the IBM CNA lists 7.5. The record shows no CISA KEV listing and no confirmed exploitation in the sources consulted.

CVE-2026-57331 is a critical arbitrary file deletion issue in the Paid Videochat Turnkey Site plugin, described as affecting versions up to and including 7.4.8. The CNA Patchstack scored it 9.9 under CVSS 3.1 and classified it as path traversal (CWE-22). The record shows no KEV listing and no confirmed exploitation in the sources consulted, and it lists no fixed version.

Budibase versions before 3.39.9 contain a mass assignment weakness (CWE-915) in the publicly reachable webhook trigger endpoint, where the full request body is passed into automation parameters. According to the record, an attacker can overwrite the internal appId property and have an asynchronously processed automation run in a victim's workspace. The vendor advisory describes the issue as fixed in 3.39.9.