CVE-2026-41921: Improper Neutralization of Input During Web Page Generation

Koha before 26.05.02, 25.11.07, and 25.05.13 contains a stored cross-site scripting vulnerability in the purchase suggestion handler that allows authenticated staff users to inject malicious scripts by submitting unsanitized input through the suggestion save operation. Attackers can supply crafte...

CVE-2026-75829: Improper Neutralization of Special Elements Used in a Template Engine

grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate endpoint, allowing attackers with api.pages.write permission to persist pages with process.twig enabled. Attackers can submit crafted header and content parameters to execute server-side template injection...

PT-2026-77313

Name of the Vulnerable Software and Affected Versions Blueprint Studio versions prior to 2.5.2 Description Blueprint Studio fails to consistently enforce the admin-only authorization boundary on its backend, allowing any authenticated Home Assistant user to access actions intended for...

PT-2026-80354

Oh My Posh: Arbitrary command execution via template injection in the path segment in github.com/jandedobbeleer/oh-my-posh...

PT-2026-77272

Name of the Vulnerable Software and Affected Versions GBIF Integrated Publishing Toolkit versions prior to 3.3.4 Description Remote authenticated attackers can access server-side files and state through template injection. This occurs because the template engine improperly interprets untrusted...

PT-2026-77190

Name of the Vulnerable Software and Affected Versions AWX affected versions not specified Description A server-side request forgery SSRF issue exists in the webhook status callback mechanism. When processing GitHub pull request webhooks, the system extracts the pull request.statuses url from the...

PT-2026-77337

Name of the Vulnerable Software and Affected Versions Koha versions prior to 26.05.02 Koha versions prior to 25.11.07 Koha versions prior to 25.05.13 Description A stored cross-site scripting issue exists in the purchase suggestion handler. Authenticated staff users can inject malicious scripts b...

Linux Distros Unpatched Vulnerability : CVE-2026-72256

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - netfilter: xtcluster: reject template conntracks in hash match xtclustermt treats any non-NULL nfctget result as a fully initialized conntrack and passes it to...

Exploit for Classic Buffer Overflow in Cisco Secure_Endpoint

ZendTo 6.15-8 / ClamAV exact-profile RCE and root-variant repr...

org.http4k:http4k-aws (2.25.2), org.http4k:http4k-client-apache (2.25.2) +5 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (2.25.2)

org.http4k:http4k-core MAVEN version 2.25.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 2.25.2 - org.http4k:http4k-client-apache 2.25.2 - org.http4k:http4k-client-okhttp 2.25.2 -...

org.http4k:http4k-aws (2.25.0), org.http4k:http4k-contract (2.25.0) +1 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (2.25.0)

org.http4k:http4k-core MAVEN version 2.25.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 2.25.0 - org.http4k:http4k-contract 2.25.0 - org.http4k:http4k-template-handlebars 2.25.0...

org.http4k:http4k-client-apache (1.10.0), org.http4k:http4k-contract (1.10.0) +6 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (1.10.0)

org.http4k:http4k-core MAVEN version 1.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-client-apache 1.10.0 - org.http4k:http4k-contract 1.10.0 - org.http4k:http4k-format-argo 1.10.0 ...

org.http4k:http4k-client-apache (1.5.0), org.http4k:http4k-contract (1.5.0) +6 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (1.5.0)

org.http4k:http4k-core MAVEN version 1.5.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-client-apache 1.5.0 - org.http4k:http4k-contract 1.5.0 - org.http4k:http4k-format-argo 1.5.0 -...

org.http4k:http4k-aws (3.22.3), org.http4k:http4k-client-apache (3.22.3) +10 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (3.22.3)

org.http4k:http4k-core MAVEN version 3.22.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 3.22.3 - org.http4k:http4k-client-apache 3.22.3 - org.http4k:http4k-client-apache-async 3.22...

org.http4k:http4k-aws (2.26.3), org.http4k:http4k-contract (2.26.3) +1 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (2.26.3)

org.http4k:http4k-core MAVEN version 2.26.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-aws 2.26.3 - org.http4k:http4k-contract 2.26.3 - org.http4k:http4k-template-handlebars 2.26.3...

org.http4k:http4k-client-apache (1.6.0), org.http4k:http4k-contract (1.6.0) +6 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (1.6.0)

org.http4k:http4k-core MAVEN version 1.6.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-client-apache 1.6.0 - org.http4k:http4k-contract 1.6.0 - org.http4k:http4k-format-argo 1.6.0 -...

org.http4k:http4k-client-apache (1.11.0), org.http4k:http4k-contract (1.11.0) +6 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (1.11.0)

org.http4k:http4k-core MAVEN version 1.11.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-client-apache 1.11.0 - org.http4k:http4k-contract 1.11.0 - org.http4k:http4k-format-argo 1.11.0 ...

org.http4k:http4k-client-okhttp (1.26.0), org.http4k:http4k-format-argo (1.26.0) +3 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (1.26.0)

org.http4k:http4k-core MAVEN version 1.26.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-client-okhttp 1.26.0 - org.http4k:http4k-format-argo 1.26.0 - org.http4k:http4k-format-jackson...

org.http4k:http4k-format-argo (0.21.0), org.http4k:http4k-format-jackson (0.21.0) +2 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (0.21.0)

org.http4k:http4k-core MAVEN version 0.21.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-format-argo 0.21.0 - org.http4k:http4k-format-jackson 0.21.0 - org.http4k:http4k-server-netty...

org.http4k:http4k-client-apache (0.22.0), org.http4k:http4k-contract (0.22.0) +6 more potentially affected by CVE-2026-53659 via org.http4k:http4k-core (0.22.0)

org.http4k:http4k-core MAVEN version 0.22.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.http4k:http4k-core and may be impacted: - org.http4k:http4k-client-apache 0.22.0 - org.http4k:http4k-contract 0.22.0 - org.http4k:http4k-format-argo 0.22.0 ...