CLSA-2026-1777890711 flatpak: Fix of CVE-2026-34079

CVE-2026-34079: fix arbitrary host file deletion via app-controlled ld.so cache symlink in flatpakswitchsymlinkandremove...

ipyflow (>=0.0.160, <=0.0.170), peak-finder-app (0.1.0a1) potentially affected by CVE-2026-40110 via jupyter-server (1.23.6)

jupyter-server PYPI version 1.23.6 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - ipyflow =0.0.160, =0.0.170 - peak-finder-app 0.1.0a1 Source cves: CVE-2026-40110 Source advisory: OSV:PYSEC-2026-2187...

ipyflow (>=0.0.160, <=0.0.170), peak-finder-app (0.1.0a1) potentially affected by CVE-2026-40934 via jupyter-server (1.23.6)

jupyter-server PYPI version 1.23.6 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - ipyflow =0.0.160, =0.0.170 - peak-finder-app 0.1.0a1 Source cves: CVE-2026-40934 Source advisory: OSV:PYSEC-2026-69...

carml (19.1.0), nucypher (>=0.1.0a27, <=1.2.0b1) +3 more potentially affected by CVE-2026-42304 via twisted (19.7.0)

twisted PYPI version 19.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on twisted and may be impacted: - carml 19.1.0 - nucypher =0.1.0a27, =1.1.0, =1.0.0, =0.2.0, =0.2.1 Source cves: CVE-2026-42304 Source advisory: OSV:GHSA-GRGV-6HW6-V9G4...

CVE-2026-42238

Nginx UI is a web user interface for the Nginx web server. Prior to version 2.3.8, nginx-ui exposes a backup restore endpoint POST /api/restore that is completely unauthenticated during the first 10 minutes after process startup on any fresh installation. An unauthenticated remote attacker can...

ipyflow (>=0.0.160, <=0.0.170), peak-finder-app (0.1.0a1) potentially affected by CVE-2026-40934 via jupyter-server (1.23.6)

jupyter-server PYPI version 1.23.6 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - ipyflow =0.0.160, =0.0.170 - peak-finder-app 0.1.0a1 Source cves: CVE-2026-40934 Source advisory: OSV:GHSA-5MRQ-X3X5-8V8F...

ipyflow (>=0.0.160, <=0.0.170), peak-finder-app (0.1.0a1) potentially affected by CVE-2026-40110 via jupyter-server (1.23.6)

jupyter-server PYPI version 1.23.6 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - ipyflow =0.0.160, =0.0.170 - peak-finder-app 0.1.0a1 Source cves: CVE-2026-40110 Source advisory: OSV:GHSA-24QX-W28J-9M6P...

ipyflow (>=0.0.160, <=0.0.170), peak-finder-app (0.1.0a1) potentially affected by CVE-2026-35397 via jupyter-server (1.23.6)

jupyter-server PYPI version 1.23.6 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - ipyflow =0.0.160, =0.0.170 - peak-finder-app 0.1.0a1 Source cves: CVE-2026-35397 Source advisory: OSV:GHSA-5789-5FC7-67V3...

ipyflow (>=0.0.160, <=0.0.170), peak-finder-app (0.1.0a1) potentially affected by CVE-2025-61669 via jupyter-server (1.23.6)

jupyter-server PYPI version 1.23.6 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - ipyflow =0.0.160, =0.0.170 - peak-finder-app 0.1.0a1 Source cves: CVE-2025-61669 Source advisory: OSV:GHSA-QH7Q-6QM3-653W...

ipyflow (>=0.0.160, <=0.0.170), peak-finder-app (0.1.0a1) potentially affected by CVE-2025-61669 via jupyter-server (1.23.6)

jupyter-server PYPI version 1.23.6 is affected by a known vulnerability. The following packages have a transitive dependency on jupyter-server and may be impacted: - ipyflow =0.0.160, =0.0.170 - peak-finder-app 0.1.0a1 Source cves: CVE-2025-61669 Source advisory: OSV:PYSEC-2026-67...

Security Bulletin: Investigation Assistant App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary The product includes vulnerable components e.g., framework libraries that could be identified and exploited with automated tools. Investigation Assistant App for IBM QRadar SIEM has addressed the applicable CVEs in an update. Vulnerability Details CVEID:CVE-2026-40175 DESCRIPTION: Axios i...

EUVD-2026-27235

An issue was discovered in the PaperCut Hive Ricoh embedded application. When the "Deep Logging" diagnostic mode is enabled, the application inadvertently records administrative credentials in plain text within the log files. An attacker with administrative access to the PaperCut Hive management...

CVE-2026-7823 Totolink A8000RU cstecgi.cgi setAppFilterCfg os command injection

A security flaw has been discovered in Totolink A8000RU 7.1cu.643b20200521. Affected is the function setAppFilterCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument enable results in os command injection. The attack may be launched remotely. The exploit has been released to the...

CVE-2026-7788 Axle-Bucamp MCP-Docusaurus document.py get_content path traversal

A security flaw has been discovered in Axle-Bucamp MCP-Docusaurus up to 404bc028e15ec304c9a045528560f4b5f27a17e0. The affected element is the function updatedocument/continuedocument/deletedocument/getcontent of the file app/routes/document.py. Performing a manipulation of the argument DOCSDIR/pa...

PT-2026-36937

A security flaw has been discovered in Axle-Bucamp MCP-Docusaurus up to 404bc028e15ec304c9a045528560f4b5f27a17e0. The affected element is the function update document/continue document/delete document/get content of the file app/routes/document.py. Performing a manipulation of the argument DOCS...

CVE-2026-7788: Improper Limitation of a Pathname to a Restricted Directory

A security flaw has been discovered in Axle-Bucamp MCP-Docusaurus up to 404bc028e15ec304c9a045528560f4b5f27a17e0. The affected element is the function updatedocument/continuedocument/deletedocument/getcontent of the file app/routes/document.py. Performing a manipulation of the argument DOCSDIR/pa...

CVE-2026-7776

creationtimestamp| type| source ---|---|--- 2026-05-04 22:49:42+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3ml2qzjvh2626 2026-05-04 23:06:33+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml2rxo7cyx2p 2026-05-05 02:09:50+00:00| seen|...

CVE-2026-42155

creationtimestamp| type| source ---|---|--- 2026-05-04 20:56:34+00:00| published-proof-of-concept| https://github.com/OpenMage/magento-lts/security/advisories/GHSA-2cwr-gcf9-pvxr 2026-05-16 03:00:30+00:00| seen| https://bsky.app/profile/offseq.bsky.social/post/3mlwu63uqud2d...

CVE-2026-41925

creationtimestamp| type| source ---|---|--- 2026-05-04 20:42:22+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3ml2jvukepv2v...

CVE-2026-7671

A vulnerability has been found in CodeWise Tornet Scooter Mobile App 4.75 on iOS/Android. The impacted element is an unknown function of the file /TwoFactor. Such manipulation leads to improper restriction of excessive authentication attempts. The attack may be performed from remote. Attacks of...