CVE
109 articles · page 7 of 10
Part of Security wire
WatchGuard Fireware iked type-confusion on IKE_AUTH
How to fix CVE-2026-19315: upgrade Fireware OS to 2026.2.2, 12.12.2, or 12.5.20
HOL Guard
CVE-2026-81934: Redis TLS pending-list use-after-free
CVE-2026-81934 is High (CVSS 7.5). Upgrade Redis Open Source to 8.10.1, 8.8.2, 8.6.6, 8.4.6, 8.2.9, 7.4.11, 7.2.16, or 6.2.24.
HOL Guard
CVE-2026-19042: TeamViewer Linux Chat Link Command Injection (and Sibling CVE-2026-16444)
How to fix CVE-2026-19042: upgrade TeamViewer Full Client and Host for Linux to 15.81
HOL Guard
CVE-2026-45018: Chainlit MCP stdio unauthenticated RCE (and sibling CVE-2026-45019)
How to fix CVE-2026-45018: upgrade chainlit to 2.12.0, then restart so /mcp loads the new wheel
HOL Guard
Next.js August 2026 fixes: CVE-2026-75604 Windows RCE and separate AVIF issue
CVE-2026-75604 is the Windows incremental-cache path traversal. Upgrade Next.js to 15.5.24 or 16.3.3. The AVIF optimizer issue is separate.
HOL Guard
CVE-2026-80104: DB-GPT Skill Upload Path Traversal (and Sibling CVE-2026-73034)
CVE-2026-80104: v0.8.1 contains the original skill-upload fix, but v0.8.2 regresses it; v0.8.2 fixes sibling CVE-2026-73034
HOL Guard
CVE-2026-63072: OpenSSL CMS decrypt writes eight bytes past the unwrap buffer
How to fix CVE-2026-63072: upgrade OpenSSL to 3.0.22, 3.4.7, 3.5.8, 3.6.4, or 4.0.2. CMS_decrypt writes eight bytes past the unwrap buffer. Same 25 August advisory as eight sibling CVEs. Not RCE. FIPS module not in scope.
HOL Guard
CVE-2026-53561: Apache Hive HiveServer2 SAML Bearer Impersonation
How to fix CVE-2026-53561: upgrade Apache Hive to 4.2.1. Unauthenticated SAML Bearer impersonation in HiveServer2 HTTP. Same 4.2.1 train as Metastore SQLi and Avro SerDe SSRF. Not RCE. Not the Kerberos default.
HOL Guard
CVE-2026-5006: Vault Privilege Escalation via Slash Injection in Templated Policy Paths
How to fix CVE-2026-5006: upgrade HashiCorp Vault Community Edition to 2.0.4 (Enterprise 2.0.4, 1.21.9, 1.20.14, or 1.19.20), then set deny_slash_in_templated_paths = true. Templated policy paths interpolate identity values. A slash in a controlled identity value becomes extra path segments and can grant capabilities the author did not intend. The deny-slash option defaults to false even after upgrade.
HOL Guard
CVE-2026-75899: fast-uri SSRF via Repeated Hostname Decoding
How to fix CVE-2026-75899: upgrade fast-uri to 2.4.5, 3.1.6, or 4.1.3. Nested percent-encoding in a hostname becomes localhost after normalize() or resolve(). Not RCE. Same patch train as three sibling High SSRF and host-confusion GHSAs.
HOL Guard
CVE-2026-18420: OpenSearch Dashboards TSVB Prototype Pollution RCE
How to fix CVE-2026-18420: upgrade OpenSearch Dashboards to 3.8.0. Authenticated TSVB metrics JSON prototype pollution RCE. Affects OSS and AWS Managed >=3.0.0 <3.8.0.
HOL Guard
CVE-2026-19516: Grafana MCP Server SSRF Via Caller-Controlled URL Header
CVE-2026-19516 is a server-side request forgery in the Grafana MCP Server. A caller can set the X-Grafana-URL header to any destination and use the grafana_api_request tool to reach internal services and cloud metadata endpoints. Fixed in mcp-grafana 1.1.0 and later.
Michael KantorRelated topics
Keep exploring
The engineering desk continues across the ecosystem: security research on shipping agents safely, and plugins that put the standards to work.