PT-2026-103984

Joyland AI app does not verify hostnames, allowing a malicious host to connect or intercept chat messages...

PT-2026-105909

Impact The vk-app backend accepted VK application callback data without verifying the callback signature when the auth key parameter was omitted. Applications using this backend could treat unsigned attacker-controlled data as a verified VK identity. An attacker could choose callback fields such ...

Rocky Linux 8 [CIQ] Security Update: perl-App-cpanminus / perl-CPAN-DistnameInfo / perl-CPAN-Meta-Check / etc (crlsa-2024_10219)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202410219 advisory. perl-App-cpanminus: Insecure HTTP in App::cpanminus Allows Code Execution Vulnerability CVE-2024-45321 Tenable has extracted the preceding description block direct...

Rocky Linux 9 [CIQ] Security Update: perl-App-cpanminus (crlsa-2024_10218)

The Rocky Linux 9 host has a package installed that is affected by a vulnerability as referenced in the CIQ crlsa-202410218 advisory. perl-App-cpanminus: Insecure HTTP in App::cpanminus Allows Code Execution Vulnerability CVE-2024-45321 Tenable has extracted the preceding description block direct...

AlmaLinux 9.2 [TuxCare] Security Update: flatpak / flatpak-devel / flatpak-libs / flatpak-selinux / etc (ALMALINUX9.2:CLSA-2026:1789979782)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1789979782 advisory. - In Flatpak before 1.18.1, a malicious sandboxed app can obtain arbitrary read and write access to files on the host, which can be escalated...

AlmaLinux 9.2 [TuxCare] Security Update: perl-App-cpanminus / perl-App-cpanminus-tests (ALMALINUX9.2:CLSA-2025:1762957887)

The AlmaLinux 9.2 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.2:CLSA-2025:1762957887 advisory. - The App::cpanminus package through 1.7047 for Perl downloads code via insecure HTTP, enabling code execution for network attackers...

GHSA-HJ66-6F7G-4R5V vulnerabilities

Vulnerabilities for packages: kubeflow-katib, ggshield, mlrun, kserve-pmmlserver-fips, kserve-xgbserver, dagster-fips, kubeflow-jupyter-web-app, authentik, kserve-lgbserver, kubeflow-pipelines-fips, kubeflow-pipelines, litellm, pgadmin4-fips, datadog-agent-fips, openstack-keystone-2026.1,...

CVE-2026-49264 vulnerabilities

Vulnerabilities for packages: kubeflow-katib, ggshield, mlrun, kserve-pmmlserver-fips, kserve-xgbserver, dagster-fips, kubeflow-jupyter-web-app, authentik, kserve-lgbserver, kubeflow-pipelines-fips, kubeflow-pipelines, litellm, pgadmin4-fips, datadog-agent-fips, openstack-keystone-2026.1,...

GHSA-HJ66-6F7G-4R5V vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, kubeflow-pipelines-visualization-server, jupyter-base-notebook, k8s-sidecar, kserve, datadog-agent, ggshield, kubeflow-katib, kubeflow-volumes-web-app, dask-kubernetes, kubeflow-jupyter-web-app, az, open-webui...

CVE-2026-49264 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, kubeflow-pipelines-visualization-server, jupyter-base-notebook, k8s-sidecar, kserve, datadog-agent, ggshield, kubeflow-katib, kubeflow-volumes-web-app, dask-kubernetes, kubeflow-jupyter-web-app, az, open-webui...

CVE-2026-55224

MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates...

CVE-2026-55224 MineAdmin: Path Traversal via Unsanitized identifier in Plugin Install/Uninstall

MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates...

EUVD-2026-90209

MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates...

CVE-2026-55224 MineAdmin: Path Traversal via Unsanitized identifier in Plugin Install/Uninstall

MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates...

CVE-2026-55224

The MineAdmin backend management system is vulnerable to a path traversal flaw in its app-store plugin service prior to version 3.2.0-alpha.2 . The application fails to sanitize the user-supplied identifier parameter, concatenating it directly into filesystem paths within plugin/mine-admin/app-st...

CVE-2026-55224 MineAdmin: Path Traversal via Unsanitized identifier in Plugin Install/Uninstall

MineAdmin is a ready-to-use backend management system suitable for quickly building website backends, operation platforms, permission centers, internal management systems, CMS, CRM, OA, ERP and other business applications. Prior to version 3.2.0-alpha.2, the app-store plugin service concatenates...

CVE-2026-55176 Soft Machine: Cross-tenant workspace API auth bypass via shared `CONTAINER_SHARED_SECRET` bearer token

Soft Machine is a Virtual Machine–based agentic development environment / Cloud OS. In versions 0.2.247 and prior, two authentication helpers in /app/server.js — verifyContainerAuth and authenticateWorkspaceHttp — accept the global CONTAINERSHAREDSECRET as a bearer token without verifying which...

CVE-2026-75098

The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.3 via the 'svg' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive...

CVE-2026-92712

The ReactPress – Create React App for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'permalink' parameter in all versions up to, and including, 3.4.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attacker...

CVE-2026-75098 Product Designer App <= 1.1.3 - Unauthenticated Arbitrary File Read via 'svg' Parameter in pdapp-render-design

The Product Designer App plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 1.1.3 via the 'svg' parameter parameter. This makes it possible for unauthenticated attackers to read the contents of arbitrary files on the server, which can contain sensitive...