CVE Vulnerability Catalog

CVE-2026-8934 is a Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console, allowing an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects using a specially crafted request.

IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 allow an attacker to retrieve user passwords and cryptographic keys from memory. The attacker can use the same keys to decrypt passwords, gain access to the application, and access sensitive data in the database.

IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 are vulnerable to cross-site scripting (XSS). An unauthenticated attacker can embed arbitrary JavaScript code in the Web UI, altering intended functionality and potentially leading to credential disclosure within a trusted session.

An SSRF vulnerability in IBM Watson Speech Services Cartridge allows an authenticated attacker to send unauthorized requests from the system, potentially leading to network enumeration or facilitating other attacks. The issue affects the Sterling File Gateway component used in speech runtimes.

Vulnerability in Angular prior to versions 22.0.1, 21.2.17, and 20.3.25 allows DOM Clobbering attack on SSR hydration mechanism. An attacker can replace the DOM element with id 'ng-state' before the state script is loaded, leading to parsing controlled data as JSON.

The vulnerability in Angular affects the HttpTransferCache mechanism used during Server-Side Rendering (SSR). An attacker can exploit a weak 32-bit DJB2 hash to cause collisions, overwriting sensitive endpoint responses in the TransferState cache. The issue is fixed in versions 22.0.1, 21.2.17, and 20.3.25.

In Angular, a vulnerability in the @angular/compiler package allows bypassing DOM property sanitization through two-way property bindings. When a property requiring sanitization (e.g., innerHTML, srcdoc, src, href, data, sandbox) is bound using two-way syntax ([(...)] or bindon-...), the compiler fails to apply the appropriate sanitizer, enabling an attacker who controls the property value to perform client-side XSS.

In Angular, in the @angular/service-worker package, there is an information disclosure vulnerability. When the Service Worker fetches assets, it preserves metadata (such as headers) from the original request, but on cross-origin redirects, it fails to strip sensitive headers, violating the Fetch redirect algorithm. This allows a remote attacker to obtain sensitive credentials (e.g., Authorization tokens, Proxy-Authorization credentials, or session cookies) by triggering a cross-origin redirect to an untrusted external origin.

Vulnerability in node-tar (before 7.5.16) involves incorrect processing of PAX extended headers. The library erroneously applies the size override from a PAX header to intermediate metadata headers (e.g., GNU long-name), causing stream desynchronization compared to other tar implementations. This allows crafting an archive that is interpreted differently by different tools.

A vulnerability in js-yaml prior to versions 4.2.0 and 3.15.0 allows a DoS attack via a crafted YAML document with a repeatedly aliased merge key (<<). This causes quadratic parse-time complexity, potentially blocking the Node.js event loop for seconds with a relatively small payload (tens of KB).

In @angular/core prior to versions 22.0.0-rc.2, 21.2.15, 20.3.22, and 19.2.23, a vulnerability allows bypassing script-execution restrictions during dynamic component creation. The createComponent mechanism fails to reject mounting components directly onto a <script> or namespaced script element (e.g., <svg:script>), enabling attackers to inject and execute untrusted code (XSS).

A vulnerability in Angular allows bypassing HTML element and attribute sanitization using namespaces. An attacker can inject malicious JavaScript code that executes in the victim's browser, leading to XSS.

In qSnapper before version 1.3.3, lack of authentication in the "snapshot diff" functions allowed a local attacker to read otherwise read-protected information.

A heap-based buffer overflow was found in dnsmasq. When DNSSEC validation and query logging are both enabled, logging of DS or DNSKEY replies containing unsupported algorithm or digest types can cause dnsmasq to write past the end of an internal logging buffer. A remote attacker able to supply such a DNS response may crash the dnsmasq process, resulting in denial of service.

The fix for CVE-2026-2443 was regressed by a subsequent rework commit that replaced specific overflow checks with a general signed comparison. When a client sends a Range request with a suffix length exceeding the content size, the resulting negative start value is not properly clamped, leading to malformed HTTP 206 responses and log flooding.

A path traversal vulnerability exists in version 3.14.0 of the Keras library, related to the `DiskIOStore.make` method. The issue arises from improper handling of user-provided layer names, allowing unauthorized file system operations.

Akaunting version 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the document timeline shown on invoice and bill detail pages. An authenticated user can store HTML/JavaScript in their profile name.

Akaunting 3.1.21 contains an authenticated stored cross-site scripting vulnerability in the reusable delete confirmation flow. A user with permission to create or modify records, such as Items, can store HTML/JavaScript in the record name.

IBM TRIRIGA Application Platform versions 5.0.2 through 5.0.3 are vulnerable to cross-site scripting (XSS). An authenticated user can embed arbitrary JavaScript code in the Web UI, potentially leading to credential disclosure within a trusted session.

IBM Engineering Workflow Management versions 7.0.2 through 7.0.2 Interim Fix 035, 7.0.3 through 7.0.3 Interim Fix 017, and 7.1 through 7.1 Interim Fix 004 are vulnerable to HTTP header injection due to improper validation of input in the HOST headers. This could allow an attacker to conduct various attacks against the vulnerable system, including cross-site scripting, cache poisoning, or session hijacking.