Linked Field - Moderately critical - Server-side template injection - SA-CONTRIB-2026-200

This module enables you to link the output of a field to a URL or to the value of another field. The module doesn't sufficiently separate field content from template code when rendering linked field output. Depending on the Twig extensions installed on the site, this can be used to expose site...

PT-2026-107708

Name of the Vulnerable Software and Affected Versions Splunk MCP Server versions prior to 1.2.1 Description Splunk MCP Server contains a Server-Side Request Forgery SSRF flaw where the platform authentication token of a user running a custom API tool may be sent to the URL configured for that too...

PT-2026-107710

Vault's PKI secrets engine ACME server did not restrict certificate identities that ACME challenges do not validate when issuing certificates under the default directory policy. This may allow an ACME client to obtain a certificate containing unverified identity claims, potentially enabling...

PT-2026-107576

Gophish through 0.12.1 contains stored and reflected cross-site scripting vulnerabilities that allow attackers to inject script by returning malicious SMTP server error messages. Attackers controlling or intercepting a sending profile's SMTP server can execute script when administrators view...

PT-2026-107557

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-31 Description A client connected to the distributed pixel cache server can send crafted pixel data that triggers an integer-size calculation error and a heap buffer overwrite, resulting in a server crash. A...

PT-2026-107564

LMCache through 0.5.5 contains a missing authentication vulnerability in the multiprocess mode HTTP server that allows remote unauthenticated attackers to access management endpoints listening on all interfaces by default. Attackers can read environment credentials via GET /env and configuration...

PT-2026-107553

Name of the Vulnerable Software and Affected Versions ImageMagick versions prior to 7.1.2-32 Description An unauthenticated adjacent-network client can cause a denial of service by repeatedly connecting to the distributed pixel cache server, which exhausts the available connections. Recommendatio...

VulnCheck KEV: CVE-2026-29058

AVideo is a video-sharing Platform software. Prior to version 7.0, an unauthenticated attacker can execute arbitrary OS commands on the server by injecting shell command substitution into the base64Url GET parameter. This can lead to full server compromise, data exfiltration e.g., configuration...

VulnCheck KEV: CVE-2026-26216

Crawl4AI versions prior to 0.8.0 contain a remote code execution vulnerability in the Docker API deployment. The /crawl endpoint accepts a hooks parameter containing Python code that is executed using exec. The import builtin was included in the allowed builtins, allowing unauthenticated remote...

PT-2026-107390

Name of the Vulnerable Software and Affected Versions wolfSSL wolfSSH versions 1.2.0 through 1.5.0 Description In the src/internal.c file, the server incorrectly accepts server-to-client Diffie-Hellman group exchange messages, specifically SSH MSG KEX DH GEX GROUP 31 and SSH MSG KEX DH GEX REPLY...

PT-2026-107374

In affected versions of Octopus Server, an authenticated user with permission to modify roles could bypass the protections preventing access abuse resulting in privilege escalation. It was possible for the built-in role to be weakened and the attacker's account added to a privileged team. This wa...

CentOS Linux 8.5 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS8.5:CLSA-2026:1791391794)

The CentOS Linux 8.5 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.5:CLSA-2026:1791391794 advisory. - NULL Pointer Dereference vulnerability in Apache HTTP Servers modheartmonitor over unicast listener. This issue affects Apache HTT...

CentOS Linux 8.4 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS8.4:CLSA-2026:1791392163)

The CentOS Linux 8.4 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS8.4:CLSA-2026:1791392163 advisory. - NULL Pointer Dereference vulnerability in Apache HTTP Servers modheartmonitor over unicast listener. This issue affects Apache HTT...

CentOS Linux 8 [TuxCare] Security Update: httpd / httpd-devel / httpd-filesystem / httpd-manual / httpd-tools / etc Multiple Vulnerabilities (CENTOS-STREAM8:CLSA-2026:1791396690)

The CentOS Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS-STREAM8:CLSA-2026:1791396690 advisory. - NULL Pointer Dereference vulnerability in Apache HTTP Servers modheartmonitor over unicast listener. This issue affects Apache...

Rocky Linux 9 [CIQ] Security Update: mariadb-connector-c / mariadb-connector-c-config / etc (crlsa-2026_75673)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202675673 advisory. mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysqlrealescapestring CVE-2026-44172 Tenable has extracted th...

RHEL 8 : mod_auth_openidc:2.3 (RHSA-2026:77371)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:77371 advisory. The modauthopenidc is an OpenID Connect authentication module for Apache HTTP Server. It enables an Apache HTTP Server to operate as an OpenID Conne...

PT-2026-107675

Name of the Vulnerable Software and Affected Versions Argo CD versions prior to 3.5.4 Description Four critical flaws affect the repo-server and clusters, including an AppProject hook bypass. Approximately 62.1k instances are identified globally. Recommendations Upgrade to version 3.5.4...

Security update for python-fsspec (important)

openSUSE security update: security update for python-fsspec ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:22028-1 Rating: important References: bsc1284173 Cross-References: CVE-2026-104851 Affected Products: openSUSE Leap 16.0...

CVE-2023-45878

CVE-2023-45878 GibbonEdu Gibbon Exploit version 25.0.1 GibbonEdu Gibbon version 25.0.1 and before GibbonEdu Gibbon version 25.0.1 and before allows Arbitrary File Write Read More https://nvd.nist.gov/vuln/detail/CVE-2023-45878 https://herolab.usd.de/security-advisories/usd-2023-0025/ Disclaimer...

nextjs-CVE-2025-55182

CVE-2025-55182 / CVE-2025-66478 React2Shell - Prueba de Concepto PoC de Ejecución Remota de Código RCE en Next.js Vulnerabilidad crítica en las Server Actions de Next.js que permite Ejecución Remota de Código sin autenticación a través de la deserialización del Protocolo React Flight Descripción...