Everything Patch Observer has reported about NVD: 11 stories, newest first. Part of our Vulnerabilities coverage.
A high-severity broken authorization flaw in SolarWinds Observability Self-Hosted allows low-privileged users to access and modify information beyond permissions.
An insecure default in Coze Studio allows registered users to run unsandboxed code, risking API key theft and database access until version 0.5.0 is deployed.
A zero-width image processing error in Pillow versions before 13.0.0 allows attackers to crash applications. The vendor has released a fix for this high-severity vulnerability.
A high-severity flaw in OpenTelemetry HTTP exporters disables certificate checks, allowing attackers to intercept sensitive metrics and logs.
Unauthenticated attackers can forge admin session tokens in OpenBMB StaffDeck versions up to 0.5.6, granting full tenant administration access via a hard-coded secret.
A high-severity flaw in libp2p-rust allows remote peers to exhaust memory via unbounded topic handling. Version 0.49.5 patches the issue.
Unhandled email errors crash Parse Server processes, allowing clients to force shutdowns until a fix is applied.
A high-severity memory corruption flaw in HPE NonStop HTTP Webserver versions T1144L24^AAL and earlier can cause system halts, requiring inventory checks.
A critical vulnerability in Omnispace Agora Project allows attackers to predict default passwords, enabling account takeover before legitimate users can log in.
A use-after-free vulnerability in Microsoft Windows DHCP Server allows network-based remote code execution, demanding immediate attention from infrastructure teams.
The NVD rates CVE-2026-93927 as critical, warning that Axiomthemes Veto versions up to 1.6.0 allow object injection through untrusted data.