NetworkManager: NetworkManager: Local privilege escalation via malformed MUD URLs in dhclient backend

A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processing malformed Manufacturer Usage Description MUD URLs. A local user can exploit this flaw to escalate privileges by triggering a script via a crafted MUD URL,...

html/template: golang: Go html/template: Cross-Site Scripting via improper URL escaping in meta tag content

A flaw was found in the html/template package of Go. A remote attacker could exploit this vulnerability by inserting ASCII whitespaces around the equals sign = within a URL's content attribute inside a tag. This improper escaping could lead to Cross-Site Scripting XSS, allowing the attacker to...

Moderate: Red Hat Security Advisory: NetworkManager security update

An update for NetworkManager is now available for Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support and Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common...

NetworkManager: NetworkManager: Local privilege escalation via malformed MUD URLs in dhclient backend

A flaw was found in NetworkManager. This local privilege escalation vulnerability exists in NetworkManager's dhclient backend when processing malformed Manufacturer Usage Description MUD URLs. A local user can exploit this flaw to escalate privileges by triggering a script via a crafted MUD URL,...

CVE-2026-82681

Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the...

EUVD-2026-68327

Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the...

CVE-2026-51719

Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove URL filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83752

Name of the Vulnerable Software and Affected Versions ToolJet versions prior to 3.16.208 Description An authorization bypass exists in TooljetDB controller endpoints that accept organizationId from the URL path without verifying if it matches the authenticated user's workspace. This allows...

PT-2026-83748

Name of the Vulnerable Software and Affected Versions ToolJet versions prior to 3.16.208 Description An issue exists where organization membership is not validated in database read routes. This allows any authenticated user to access table schemas and row data belonging to other organizations. An...

CVE-2026-53552: Authorization Bypass Through User-Controlled Key

Goploy is an open-source automation deployment system. In versions 1.17.5 and prior, Project.AddFile, Project.EditFile, Project.RemoveFile, and Project.Edit in cmd/server/api/project/handler.go accept a project or project-file row id from the JSON body and act on it without checking that the...

PT-2026-83704

NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL or redirect parameter...

EUVD-2026-68676

Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove URL filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

CVE-2026-82681: Improper Encoding or Escaping of Output

Improper Encoding or Escaping of Output vulnerability in ash-project ashadmin lets an attacker who controls a record's string primary key rewrite the target of AshAdmin's row-action links. The Table, DataTable, and Show components built row-action URLs by raw string interpolation, splicing the...

CVE-2026-51719

Incorrect access control in the delUrlFilterRules function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to remove URL filtering rules via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-84053

Name of the Vulnerable Software and Affected Versions hyperledger-firefly versions prior to 1.4.1 Description A server-side request forgery SSRF exists within the Webhook Subscription component. This occurs when the url argument is manipulated in the ValidateOptions function located in the...

CVE-2026-40465: URL Redirection to Untrusted Site

NSP is vulnerable to an open redirect due to insufficient server-side validation of the URL or redirect parameter...

CVE-2026-81889: Server-Side Request Forgery (SSRF)

elFinder is an open-source file manager for web, written in JavaScript using jQuery UI. Prior to 2.1.70, elFinder URL uploads in php/elFinder.class.php can bypass server-side request forgery protections when PHP cURL is unavailable because validateaddress validates $info'ip', but getremotecontent...

RHEL 8 : NetworkManager (RHSA-2026:61239)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61239 advisory. NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when...

PT-2026-83725

Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended access controls...

CVE-2026-51152

Server-side request forgery SSRF in the /har/test endpoint in QD 20220208 through 20250803. Fetcher.buildrequest in libs/fetcher.py constructs an httpclient.HTTPRequest from user-supplied JSON without validating URL scheme, host, or IP range. The /har/test handler does not require authentication,...