CVE-2026-44177 Kirby: Pre-authentication path traversal and PHP file inclusion during user lookup

Kirby is an open-source content management system. In versions 5.3.0 and above but prior to 5.4.1, Kirby did not correctly validate the provided user ID, resulting in a path traversal vulnerability. Version 5.3.0 introduced a performance improvement to the Users collection that loaded user object...

CVE-2026-62963 Centrifugo: Decompression bomb DoS via permessage-deflate in unidirectional WebSocket transport

Centrifugo is an open-source scalable real-time messaging server. Prior to 6.8.4, Centrifugo unidirectional WebSocket transport with uniwebsocket.compression enabled enforced uniwebsocket.messagesizelimit against compressed wire-frame length in internal/websocket/conn.go advanceFrame, but...

EUVD-2026-44992

dbt-mcp is a Model Context Protocol server for interacting with dbt. Prior to 1.17.1, DefaultUsageTracker.emittoolcalledevent in src/dbtmcp/tracking/tracking.py serialized every MCP tool call's complete arguments dictionary and sent it through dbtlabsvortex.producer.logproto without redaction,...

CVE-2026-59864

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.32.5, kiota plugin add and kiota plugin generate with -t APIPlugin emitted attacker-controlled statictemplate.file values from x-ai-adaptive-card and x-ai-capabilities into generated Microsoft 365 Copilot and Teams plugin...

Security update for libssh2_org

This update for libssh2org fixes the following issue CVE-2026-55199: pre-Authentication DoS via SSHMSGEXTINFO Handler bsc1268530. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the...

SUSE-SU-2026:3082-1 Security update for libssh2_org

This update for libssh2org fixes the following issue - CVE-2026-55199: pre-Authentication DoS via SSHMSGEXTINFO Handler bsc1268530...

CVE-2026-47729

Squid is a caching proxy for the Web. Prior to 7.6, due to an improper validation of syntactic correctness of input in the FTP gateway src/clients/FtpGateway.cc, Squid is vulnerable to an out-of-bounds read: when a listing entry date in the TypeA or TypeB directory-listing formats is not followed...

Security update for libssh2_org

This update for libssh2org fixes the following issue CVE-2026-55199: pre-Authentication DoS via SSHMSGEXTINFO Handler bsc1268530. Patch Instructions: To install this SUSE update use the SUSE recommended installation methods like YaST onlineupdate or "zypper patch". Alternatively you can run the...

SUSE-SU-2026:3076-1 Security update for libssh2_org

This update for libssh2org fixes the following issue - CVE-2026-55199: pre-Authentication DoS via SSHMSGEXTINFO Handler bsc1268530...

EUVD-2026-44909

Inconsistent interpretation of HTTP requests HTTP response smuggling vulnerability in elixir-mint mint allows a malicious HTTP/1 server to desynchronize a strict intermediary and the Mint client on the same pooled connection, enabling response-queue poisoning against subsequent requests that shar...

Daxin Resurfaces in Taiwan Alongside Stupig Pre-Login SYSTEM Backdoor

An advanced malware previously attributed to a China-linked threat actor has resurfaced after more than four years within a Taiwan manufacturing firm, along with a previously unreported backdoor dubbed Stupig. Daxin "srt64.sys", as the kernel-mode rootkit is referred to, was first documented by...

Security update for libssh2_org

This update for libssh2org fixes the following issue Security changes: CVE-2026-55199: pre-Authentication DoS via SSHMSGEXTINFO Handler bsc1268530. Other changes: rebuild libssh2org against openssl 1.1.1, enabling ed25519 support. bsc1227490 Patch Instructions: To install this SUSE update use the...

SUSE-SU-2026:3074-1 Security update for libssh2_org

This update for libssh2org fixes the following issue Security changes: - CVE-2026-55199: pre-Authentication DoS via SSHMSGEXTINFO Handler bsc1268530. Other changes: - rebuild libssh2org against openssl 1.1.1, enabling ed25519 support. bsc1227490...

JetBrains YouTrack < 2026.2.17394 Stored XSS (CVE-2026-61492)

The version of JetBrains YouTrack installed on the remote host is prior to 2026.2.17394. It is, therefore, affected by a stored cross-site scripting vulnerability: - Stored XSS via article titles in digest emails was possible. CVE-2026-61492 Note that Nessus has not tested for this issue but has...

openSUSE 16 Security Update : go1.26 (openSUSE-SU-2026:21341-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21341-1 advisory. This update for go1.26 fixes the following issues - Update to version go1.26.5 bsc1255111. - CVE-2026-39822: os: Root escape via symlink plus...

Linux Distros Unpatched Vulnerability : CVE-2026-12606

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Eclipse Grizzly in versions before 5.0.2, cannot properly parse the trailer section in malformed trailer header's line, which can be leveraged to perform HTTP...

PT-2026-60451

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified AWS Cognito affected versions not specified Microsoft Entra ID affected versions not specified Description One issue exists in the Linux kernel where the ECSPI is incorrectly configured when a DMA...

Pomerium Pre-Auth Memory Exhaustion via Unbounded zstd Decompression in HPKE Callback

Summary The HPKE V2 URL decode path in pkg/hpke/url.go decompresses attacker-controlled zstd data without any size limit. On Pomerium deployments using the stateless authentication flow Pomerium Zero / hosted authenticate, the proxy's /.pomerium/callback endpoint is reachable without credentials...

CVE-2026-55652 Wekan: Header-login IP allowlist bypass via X-Forwarded-For spoofing in Wekan allows unauthenticated full account takeover (incl. admin)

Wekan is open source kanban built with Meteor. Prior to 9.46, header-login with HEADERLOGINTRUSTEDIPS uses getRequestIp in server/lib/headerLoginAuth.js to trust the client-supplied X-Forwarded-For header before the real socket address, allowing an unauthenticated attacker to send HEADERLOGINID f...

EUVD-2026-44827

WWBN AVideo is an open source video platform. Versions prior to 29.0 contain an unauthenticated Reflected XSS vulnerability through AVideo YouTubeAPI Gallery Pagination. The $GET'search' query parameter is concatenated directly into the href attribute of two pagination links in...