CVE-2026-108267

Privasys Go is a maintained fork of the Go programming language that adds RA-TLS support to crypto/tls. Prior to privasys-v0.5.1-go1.26.5, challenge-mode RA-TLS certificates bound quote ReportData to the certificate public key and client nonce but not to the active TLS session. An attacker who...

CVE-2026-108269

Remote Attestation TLS Clients provides multi-language utilities for verifying attested TLS connections. Prior to 0.5.0, the Rust and Go RA-TLS challenge verifiers accepted quote ReportData that was bound to the certificate public key and client nonce but not to the active TLS session before...

CVE-2026-108268

Enclave OS Virtual runs container workloads inside confidential virtual machines with end-to-end attestation. Prior to tdx-v0.2.43 and tdx-gpu-v0.6.27, the TDX/GPU RA-TLS certificate issuer placed the certificate public-key hash and client nonce in quote ReportData but omitted a value bound to th...

CVE-2026-22061 CVE-2026-22061 Debug Log Information Disclosure Vulnerability in Trident

Trident versions v25.02.1 through v26.06.1 are susceptible to a vulnerability that could allow an authenticated attacker with access to debug logs to view LUKS passphrases or SMB Active Directory credentials...

CVE-2026-22061 CVE-2026-22061 Debug Log Information Disclosure Vulnerability in Trident

Trident versions v25.02.1 through v26.06.1 are susceptible to a vulnerability that could allow an authenticated attacker with access to debug logs to view LUKS passphrases or SMB Active Directory credentials...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Cross-Site Scripting.

Summary ip-address is used by IBM Storage Fusion Data Foundation, which could cause Cross-Site Scripting. CVE-2026-42338. Vulnerability Details CVEID:CVE-2026-42338 DESCRIPTION: ip-address is a library for parsing and manipulating IPv4 and IPv6 addresses in JavaScript. Prior to 10.1.1,...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to XML Injection.

Summary fast-xml-builder is used by IBM Storage Fusion Data Foundation, which could cause XML Injection. CVE-2026-44665. Vulnerability Details CVEID:CVE-2026-44665 DESCRIPTION: fast-xml-builder builds XML from JSON. Prior to 1.1.7, when an input data has quotes in attribute values but process...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Cross-Site Scripting

Summary React Router is used by IBM Storage Fusion Data Foundation, which could cause Cross-Site Scripting. CVE-2026-22029 Vulnerability Details CVEID:CVE-2026-22029 DESCRIPTION: React Router is a router for React. In @remix-run/router version prior to 1.23.2 and react-router 7.0.0 through 7.11.0...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Denial of Service.

Summary spdystream is used by IBM Storage Fusion Data Foundation, which could cause Denial of Service. CVE-2026-35469. Vulnerability Details CVEID:CVE-2026-35469 DESCRIPTION: spdystream is a Go library for multiplexing streams over SPDY connections. In versions 0.5.0 and below, the SPDY/3 frame...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Cross-Site Scripting.

Summary postcss is used by IBM Storage Fusion Data Foundation, which could cause Cross-Site Scripting. CVE-2026-41305. Vulnerability Details CVEID:CVE-2026-41305 DESCRIPTION: PostCSS takes a CSS file and provides an API to analyze and modify its rules by transforming the rules into an Abstract...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Denial of Service.

Summary compression is used by IBM Storage Fusion Data Foundation, which could cause Denial of Service. CVE-2026-87776 Vulnerability Details CVEID:CVE-2026-87776 DESCRIPTION: compression is a Node.js and Express compression middleware. In versions before 1.8.2, when a client aborts the connection...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Denial of Service

Summary fast-xml-parser is used by IBM Storage Fusion Data Foundation, which could cause Denial of Service. CVE-2026-27942, CVE-2026-26278, CVE-2026-33036 Vulnerability Details CVEID:CVE-2026-27942 DESCRIPTION: fast-xml-parser allows users to validate XML, parse XML to JS object, or build XML fro...

Security Bulletin: IBM Storage Fusion Data Foundation is vulnerable to Information Disclosure

Summary ws is used by IBM Storage Fusion Data Foundation, which could cause Information Disclosure. CVE-2026-45736 Vulnerability Details CVEID:CVE-2026-45736 DESCRIPTION: ws is an open source WebSocket client and server for Node.js. Prior to 8.20.1, the websocket.close implementation is vulnerabl...

CVE-2026-92705

Aegisub is a cross-platform advanced subtitle editor. From 3.2.0 to 3.4.2, Aegisub automatically loads Automation scripts referenced by Automation Scripts metadata in ASS subtitle projects without asking whether the user trusts the scripts or their authors. An attacker can distribute a crafted AS...

CVE-2026-57458

Vikunja is an open-source self-hosted task management platform. In version 2.3.0, a scoped API token limited to the oauth.authorize permission can call POST /api/v1/oauth/authorize, obtain an OAuth authorization code, and exchange the code at POST /api/v1/oauth/token for a normal bearer JSON Web...

CVE-2026-108266

Privasys rustls is a maintained fork of the rustls TLS library that adds RA-TLS challenge and channel-binding support. Prior to privasys-v0.8.1, the fork emitted RA-TLS challenge certificates whose quote ReportData was bound to the certificate public key and client nonce but not to the active TLS...

CVE-2026-62367

Vikunja is an open-source self-hosted task management platform. In versions 1.0.0 through 2.3.0, when an administrator enables the per-provider emailfallback option on an OpenID Connect provider, Vikunja links an SSO login to a pre-existing local username+password account using only the email cla...

CVE-2026-62376

Vikunja is an open-source self-hosted task management platform. Versions prior to 2.4.0 store password-reset, email-confirmation, and account-deletion tokens in the usertokens table in plaintext. If an attacker gains read access to the database through a backup leak, misconfigured storage, or...

CVE-2026-108261

Tina is a headless content management system. Prior to tinacms 3.14.0 and @tinacms/app 2.5.14, the // admin preview route in packages/tinacms/src/admin/index.tsx can turn an attacker-controlled hash-router splat into an off-origin iframe URL through packages/@tinacms/app/src/preview.tsx, while...

CVE-2026-108263

Astron Agent is an agentic workflow platform for building and running AI agents. Prior to 1.1.2, the default workflow code-node path through /console-api/workflow/code/run and /workflow/v1/run selects LocalExecutor in core/workflow/engine/nodes/code/codenode.py when CODEEXECTYPE is not explicitly...