PT-2026-50524

Name of the Vulnerable Software and Affected Versions Devolutions UniGetUI versions prior to 2026.2.1 Description The pinget backend contains an issue where names or references are incorrectly resolved. This allows a WinGet community catalog contributor to correlate an installed application with ...

PT-2026-50479

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.6 Description The chat message listener in the chat page's window message listener processes input:prompt and action:submit messages without enforcing same-origin restrictions. This allows an external site to s...

PT-2026-50592

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.9.6 Description Several direct, index-addressed Ollama proxy routes allow authenticated users to bypass backend isolation. The system accepts a caller-supplied url idx path parameter and uses it as a raw index in...

CVE-2026-10696: Use of Incorrectly-Resolved Name or Reference

Use of an incorrectly resolved name or reference in the pinget backend in Devolutions UniGetUI 2026.2.0 and earlier allows a WinGet community catalog contributor to cause an installed application to be correlated to an unrelated, attacker-controlled catalog package and to execute an...

ai.wanaku:wanaku-router-backend (0.2.0), io.quarkus:quarkus-keycloak-authorization-deployment (>=3.28.0.cr1, <=3.33.2) potentially affected by CVE-2026-50559 via io.quarkus:quarkus-keycloak-authorization (>=3.28.0.cr1, <=3.33.2)

io.quarkus:quarkus-keycloak-authorization MAVEN version =3.28.0.cr1, =3.28.0.cr1, =3.33.2 Source cves: CVE-2026-50559 Source advisory: SNYK:JAVA-IOQUARKUS-17375077...

PT-2026-50543

Shaarli is a personal bookmarking service. Versions 0.16.1 and prior contain a DOM-based Cross-Site Scripting XSS vulnerability in the Thumbnail Synchronizer feature. When an administrator runs the thumbnail update process, malicious bookmark titles are returned via an AJAX response and inserted...

PT-2026-50538

Name of the Vulnerable Software and Affected Versions Tinyproxy versions prior to commit ff45d3b Description Tinyproxy fails to reconcile conflicting Content-Length and Transfer-Encoding: chunked headers, forwarding both verbatim to the backend while using Content-Length to determine the number o...

PT-2026-50495

Name of the Vulnerable Software and Affected Versions Traefik versions prior to 3.6.21 Traefik versions prior to 3.7.5 Description An issue exists in the Kubernetes Gateway provider regarding the crossProviderNamespaces allowlist. When HTTPRoute rules declare multiple backendRefs Weighted Round...

nginx -- multiple vulnerabilities

The nginx developers report: A heap memory buffer overflow vulnerability when using the "ignoreinvalidheaders off;" and "largeclientheaderbuffers" directives with large configured values while proxying a specially crafted request to an HTTP/2 or gRPC backend may allow memory corruption or a...

Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS : OpenStack Keystone vulnerabilities (USN-8433-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 25.10 / 26.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8433-1 advisory. It was discovered that OpenStack Keystone allowed restricted application credentials to create EC2 credentials. An...

Rclone: Unauthenticated command execution in `rclone rcd --rc-serve` via inline remote instantiation, bypassing CVE-2026-41179 fix

Summary rclone rcd --rc-serve accepts unauthenticated GET and HEAD requests to paths of the form: text /remote:path/object The remote value is parsed from the URL and passed to normal backend initialization. Inline remote configuration can set backend options that execute local commands during...

CVE-2026-2604

A flaw was found in evolution-data-server. Inconsistent comparison logic in the addressbook file backend allows a Flatpak application with D-Bus access to craft a malicious URI containing directory traversal sequences. This URI is stored without proper validation during contact creation or...

CVE-2026-2604

Summary: CVE-2026-2604 affects evolution-data-server. An inconsistent comparison logic in the addressbook backend lets a Flatpak/D-Bus user craft a malicious URI with directory traversal sequences. This URI is stored during contact creation/modification and later rechecked with lower strictness d...

Authentication Bypass Using an Alternate Path or Channel

Overview github.com/traefik/traefik/v2/pkg/server is a server package for traefik, a cloud native edge router. Affected versions of this package are vulnerable to Authentication Bypass Using an Alternate Path or Channel in the TLS configuration selection process for HTTP/3 connections, where an...

GHSA-82W8-QH3P-5JFQ vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9, prefect-fips, litellm, mlflow-fips, nemo, kserve, tritonserver-backend-vllm-cuda-13.0, mlflow, prefect, semgrep, airflow-core, airflow-postgres-fips, airflow...

GHSA-JP82-JPQV-5VV3 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9, prefect-fips, litellm, mlflow-fips, nemo, kserve, tritonserver-backend-vllm-cuda-13.0, mlflow, prefect, semgrep, airflow-core, airflow-postgres-fips, airflow...

CVE-2026-54282 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9, prefect-fips, litellm, mlflow-fips, nemo, kserve, tritonserver-backend-vllm-cuda-13.0, mlflow, prefect, semgrep, airflow-core, airflow-postgres-fips, airflow...

CVE-2026-54283 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9, prefect-fips, litellm, mlflow-fips, nemo, kserve, tritonserver-backend-vllm-cuda-13.0, mlflow, prefect, semgrep, airflow-core, airflow-postgres-fips, airflow...

CVE-2026-54278 vulnerabilities

Vulnerabilities for packages: dask-kubernetes-fips, tritonserver-backend-vllm-cuda-13.0, lmcache-cuda-12.8, py3-vllm-cuda-12.9, apache-beam-python-3.11-sdk, apache-beam-python-3.13-sdk, mlflow-fips, mlflow, authentik-fips, py3.13-scanner-test-libraries-aiohttp, tritonserver-backend-vllm-cuda-12.9...

CVE-2026-54275 vulnerabilities

Vulnerabilities for packages: dask-kubernetes-fips, tritonserver-backend-vllm-cuda-13.0, lmcache-cuda-12.8, py3-vllm-cuda-12.9, apache-beam-python-3.11-sdk, apache-beam-python-3.13-sdk, mlflow-fips, mlflow, authentik-fips, py3.13-scanner-test-libraries-aiohttp, tritonserver-backend-vllm-cuda-12.9...