CVE WatchNov 9, 2026

CVE-2026-124992

A vulnerability was identified in nushell up to 0.116.1. Impacted is the function escape_bytes of the file crates/nu-json/src/ser.rs of the

CVSS

3.3

Low

EPSS

—

KEV

—

Exploit Today

—

0-100

Published: Nov 9, 2026 · Last modified: Nov 9, 2026 · CWE-20 · CWE-150

EPSS · 30d

Not enough EPSS history yet.

Technical description

A vulnerability was identified in nushell up to 0.116.1. Impacted is the function escape_bytes of the file crates/nu-json/src/ser.rs of the component Data Conversion Handler. The manipulation leads to improper neutralization of escape, meta, or control sequences. The attack must be carried out locally. The pull request to fix this issue awaits acceptance.

Official references

Related CVEs

CVECVSSEPSSKEVRExploitTitleMod.

CVE-2026-1251135.3 MED

—

———The XRootD project provides a high-performance, fault-tolerant, and secure solution for handling large amounts of data distributed across multiple storage resources. Prior to version 5.9.2, XRootD's rpCheck() function in src/XrdXrootd/XrdXrootdXeq.cc rejects a parent-directory component only when two dots are followed by a slash and does not reject a terminal two-dot component. An unauthenticated attacker can append /.. to an exported path in xrdfs ls or an HTTP PROPFIND request, bypass the all.export directory scope, and cause directory and filename enumeration in the parent directory under oss.localroot. The demonstrated vector does not permit file download or disclose file contents. This issue is fixed in version 5.9.2.13h CVE-2026-63634—

—

———pympp is a Python SDK for the Machine Payments Protocol. Prior to version 0.9.1, when the server acts as the fee_payer, pympp validates calldata using eth_abi decoding, which is lenient about trailing bytes. The FeePayerPolicy caps gas_limit (≤ 2 M) and max_fee_per_gas (≤ 100 Gwei) but does not check calldata length. Tempo uses legacy calldata gas pricing: 16 gas per non-zero byte. Appending N bytes of 0x01 padding inflates actual gas used by N × 16 while keeping gas_limit and max_fee_per_gas within policy caps. The server cosigns and broadcasts the padded transaction, draining its fee-payer wallet. This issue has been patched in version 0.9.1.14h CVE-2026-123369—

—

——0compose-lint is a Docker Compose security linter that identifies dangerous misconfigurations before deployment. Prior to 0.31.0, compose-lint prints attacker-controlled service names, environment keys, file lines, and other Compose text without neutralizing GitHub Actions and Azure Pipelines workflow-command openers. When a workflow processes a pull request, legacy ##[ commands or a line-leading double-colon command can create false annotations, hide log regions, mask selected strings, or invoke other commands recognized by the runner. The affected text report paths do not alter the compose-lint exit code or pass or fail result, but they can misrepresent the CI output presented to reviewers. This issue is fixed in version 0.31.0.13h CVE-2026-1192744.8 MED

—

——0Infoblox NIOS version upto 9.1.0 contain a vulnerability related to improper input validation that allows a stored XSS21h CVE-2026-842283.1 LOW

24.3%

——7IBM Guardium Data Protection 12.2.4 could allow a remote authenticated attacker to obtain sensitive information due to improper input validation.16h CVE-2026-185254.9 MED

22.9%

——7IBM Secure Proxy 6.1.0.0 through 6.2.1.2 could allow a remote authenticated attacker to cause a denial of service due to improper validation of listener IP address and port.16h