🔴 CVE-2026-100721 - Critical (9)

vm2 before 3.12.2 contains an authorization bypass in the NodeVM external-module resolver. When a...

https://www.thehackerwire.com/vulnerability/CVE-2026-100721/

#infosec #cybersecurity #CVE #vulnerability #security #patchstack

🟠 CVE-2026-100723 - High (7.5)

vm2 before 3.12.2 does not apply its Buffer backing-store ownership invariant (byteOffset === 0 a...

https://www.thehackerwire.com/vulnerability/CVE-2026-100723/

#infosec #cybersecurity #CVE #vulnerability #security #patchstack

🟠 CVE-2026-100833 - High (8.2)

Contrast (edgelesssys/contrast) versions 1.14.0 before 1.23.1 generate runtime policies that fail...

https://www.thehackerwire.com/vulnerability/CVE-2026-100833/

#infosec #cybersecurity #CVE #vulnerability #security #patchstack

🟠 CVE-2026-100844 - High (8.4)

MONAI before 1.6.0 is vulnerable to OS command injection in the nnUNetV2Runner component (monai.a...

https://www.thehackerwire.com/vulnerability/CVE-2026-100844/

#infosec #cybersecurity #CVE #vulnerability #security #patchstack

🟠 CVE-2026-100843 - High (7.8)

MONAI versions before 1.6.0 contain a remote code execution vulnerability in the algo_from_pickle...

https://www.thehackerwire.com/vulnerability/CVE-2026-100843/

#infosec #cybersecurity #CVE #vulnerability #security #patchstack

🔴 CVE-2026-100741 - Critical (9.8)

Eval injection in the JScript event-script dispatcher in Progressive Robot Ltd's hMailServer, ver...

https://www.thehackerwire.com/vulnerability/CVE-2026-100741/

#infosec #cybersecurity #CVE #vulnerability #security #patchstack

🟠 CVE-2026-100872 - High (7.5)

Sylius versions before 2.1.16 and 2.2.9 fail to validate payment amounts during cart recalculatio...

https://www.thehackerwire.com/vulnerability/CVE-2026-100872/

#infosec #cybersecurity #CVE #vulnerability #security #patchstack

🟠 CVE-2026-100871 - High (8.8)

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 fail to include firewall iden...

https://www.thehackerwire.com/vulnerability/CVE-2026-100871/

#infosec #cybersecurity #CVE #vulnerability #security #patchstack

🟠 CVE-2026-100870 - High (8.8)

Sylius versions before 1.12.25, 1.13.17, 1.14.20, 2.1.16, and 2.2.9 build administrator password-...

https://www.thehackerwire.com/vulnerability/CVE-2026-100870/

#infosec #cybersecurity #CVE #vulnerability #security #patchstack

🟠 CVE-2026-101045 - High (8)

Fleet-maintained app install and uninstall scripts for macOS are generated from Homebrew cask met...

https://www.thehackerwire.com/vulnerability/CVE-2026-101045/

#infosec #cybersecurity #CVE #vulnerability #security #patchstack

🟠 CVE-2026-101060 - High (8.2)

python-utcp versions before 1.1.4 contain a server-side request forgery vulnerability in HttpComm...

https://www.thehackerwire.com/vulnerability/CVE-2026-101060/

#infosec #cybersecurity #CVE #vulnerability #security #patchstack

🟠 CVE-2026-101064 - High (7.6)

Obot before v0.23.0 contains a server-side request forgery vulnerability in remote MCP server reg...

https://www.thehackerwire.com/vulnerability/CVE-2026-101064/

#infosec #cybersecurity #CVE #vulnerability #security #patchstack

🟠 CVE-2026-101062 - High (8.8)

Obot before v0.23.0 (affected versions <= v0.22.1) running with OBOT_SERVER_ENABLE_AUTHENTICAT...

https://www.thehackerwire.com/vulnerability/CVE-2026-101062/

#infosec #cybersecurity #CVE #vulnerability #security #patchstack

🔴 CVE-2026-101084 - Critical (9.6)

obot versions before v0.21.1 fail to enforce Access Control Rules on the /mcp-connect endpoint, a...

https://www.thehackerwire.com/vulnerability/CVE-2026-101084/

#infosec #cybersecurity #CVE #vulnerability #security #patchstack

🔴 CVE-2026-101065 - Critical (9.8)

Obot is an open-source AI agent/MCP platform. In all versions up to and including commit d7e6970,...

https://www.thehackerwire.com/vulnerability/CVE-2026-101065/

#infosec #cybersecurity #CVE #vulnerability #security #patchstack

🔴 CVE-2026-101090 - Critical (9.8)

Nezha 2.2.3 contains a Host header injection regression in the OAuth2 redirect endpoint. When the...

https://www.thehackerwire.com/vulnerability/CVE-2026-101090/

#infosec #cybersecurity #CVE #vulnerability #security #patchstack

🟠 CVE-2026-96280 - High (7.5)

The OCI delta stream parser read sizes as guint64 but passed them to GLib I/O and allocation func...

https://www.thehackerwire.com/vulnerability/CVE-2026-96280/

#infosec #cybersecurity #CVE #vulnerability #security #patchstack

🔴 CVE-2026-100886 - Critical (10)

A vulnerability was identified in Seetong T8108, T8108P, T8116 and T8232 4.6.1.4-build20260424101...

https://www.thehackerwire.com/vulnerability/CVE-2026-100886/

#infosec #cybersecurity #CVE #vulnerability #security #patchstack

🟠 CVE-2026-100841 - High (7.8)

In MONAI 1.6.0, PersistentDataset (monai/data/dataset.py) explicitly rejects the combination trac...

https://www.thehackerwire.com/vulnerability/CVE-2026-100841/

#infosec #cybersecurity #CVE #vulnerability #security #patchstack

🟠 CVE-2026-100840 - High (7.8)

MONAI through 1.6.0 contains a remote code execution vulnerability in the bundle configuration en...

https://www.thehackerwire.com/vulnerability/CVE-2026-100840/

#infosec #cybersecurity #CVE #vulnerability #security #patchstack