Advisories
- vm2 WebAssembly sandbox escape to host code execution (Node.js 25+)CVE-2026-26956 9.8 critical
- Zulip Server Path traversal in data importCVE-2026-26058 6.1 medium
- UniFi Network Application Authenticated NoSQL injection to privilege escalationCVE-2026-22558 7.7 high
- Calibre PDB reader path traversal to arbitrary file writeCVE-2026-26065 9.3 critical CVSS 4.0
- Calibre extract_pictures() path traversal to code execution on WindowsCVE-2026-26064 9.3 critical CVSS 4.0
- OpenClaw Webhook verification bypass via forwarded headersCVE-2026-28465 5.9 medium
- FastGPT SSRF in web-page fetch and HTTP nodesCVE-2026-26075 6.9 medium CVSS 4.0
- Calibre CHM reader path traversal to Startup-folder RCECVE-2026-25635 8.6 high writeup
- Calibre EPUB path traversal to file corruption and code executionCVE-2026-25636 8.2 high writeup co-reported with CiviledCode
- CAI Argument injection in an agent tool, reachable by prompt injectionCVE-2026-25130 9.6 critical co-reported with xelitte777
Scores are CVSS 3.1 base scores unless marked CVSS 4.0.