PT-2026-98225

Name of the Vulnerable Software and Affected Versions TREK versions prior to 3.3.0 Description The getSharedTripData function in server/src/services/shareService.ts allows the retrieval of sensitive trip information via the 'GET /api/shared/:token' endpoint, even when the trip owner has disabled...

CVE-2026-88351

An integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on 32-bit platforms. When parsing a specially crafted MessagePack array32 or map32 object with an excessively large element count, the page allocation size calculation in mpacktreeparsechildren can overflow sizet and...

EUVD-2026-86022

An integer overflow vulnerability exists in the MPack Node API in MPack 1.1.1 on 32-bit platforms. When parsing a specially crafted MessagePack array32 or map32 object with an excessively large element count, the page allocation size calculation in mpacktreeparsechildren can overflow sizet and...

CVE-2026-62286: Exposure of Sensitive Information to an Unauthorized Actor

Dozzle is a realtime log viewer for docker containers. Prior to 10.6.7, streamEvents in internal/web/events.go applies a restricted user's label filter to container lists but not to the container-stat and container-event channels returned by GET /api/events/stream. In a simple-auth deployment usi...

WSO2 Multiple Products Path Traversal Vulnerability

WSO2 API Control Plane, API Manager, Traffic Manager & Universal Gateway contain a path traversal vulnerability that could allow for unrestricted file upload and lead to remote code execution...

Linux Distros Unpatched Vulnerability : CVE-2026-67218

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. Prior to versions 4.0.22, 4.1.11, 4.2.6, and 4.3.0, acceptcontent/2 at line 56 calls...

PT-2026-97833

Name of the Vulnerable Software and Affected Versions Genetec Security Center affected versions not specified Description A flaw in the authorization mechanism for the Media Gateway API allows a user without playback privileges to generate video thumbnails. Recommendations At the moment, there is...

PT-2026-97784

Name of the Vulnerable Software and Affected Versions Spectra Legacy – Gutenberg Blocks versions prior to 2.20.1 Description Sensitive information exposure occurs via the editor assets function, which exposes the uag insta linked accounts option through the uagb blocks info object without...

PT-2026-98239

Name of the Vulnerable Software and Affected Versions Docmost versions prior to 0.90.1 Description An authenticated workspace member who is not a member of a private space can access confidential content and source page metadata. This occurs because the transclusion / sync-block lookup API does n...

CVE-2026-63493: Authentication Bypass Using an Alternate Path or Channel

Snipe-IT is an IT asset/license management system. Prior to 8.7.0, a password-authenticated session for an account with self.api permission can reach the personal-access-token API flow before completing the account's second-factor challenge because CheckForTwoFactor is enforced in the web...

Linux Distros Unpatched Vulnerability : CVE-2026-67221

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqpuri:removecredentials...

Linux Distros Unpatched Vulnerability : CVE-2026-62364

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - wlc is a Weblate command-line client using Weblate's REST API. Prior to 2.0.1, automatically discovered configuration from .weblate, .weblate.ini, or weblate.in...

Linux Distros Unpatched Vulnerability : CVE-2026-66069

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, isauthorized/2 uses isauthorizedmonitor for all methods. DELETE resets...

PT-2026-97857

Name of the Vulnerable Software and Affected Versions Logto versions 1.31.0 through 1.41.0 Description Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller with a same-user access token containing only the openid scope to retrieve stored social or enterpri...

CVE-2026-63203: Missing Authorization

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with only the openid scope to retrieve stored social or enterpris...

CVE-2026-79758: Improper Access Control

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. From 1.8.0 until 2.5.1, authenticated Termix users can access the server-stats API without per-host authorization. GET /status returns statuses for hosts the requester cannot access, GET...

AZL-105738 CVE-2026-67221 affecting package rabbitmq-server 3.13.7-9

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqpuri:removecredentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET...

CVE-2026-67221

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqpuri:removecredentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET...

DEBIAN-CVE-2026-67221

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqpuri:removecredentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET...

UBUNTU-CVE-2026-67221

RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, The AMQP 0-9-1 shovel calls amqpuri:removecredentials before storing its connection URI, but the AMQP 1.0 shovel stores the raw URI including the password. The stored URI is visible via GET...