de.iip-ecosphere.platform:support.aas.basyx2.server (>=0.8.0, <=0.8.1), org.eclipse.digitaltwin.basyx:basyx.aasenvironment-client (>=2.0.0-milestone-03, <=2.0.0-milestone-09.1) +7 more potentially affected by CVE-2026-7411 via org.eclipse.digitaltwin.basyx:basyx.submodelrepository-backend (>=2.0.0-milestone-02, <=2.0.0-milestone-09.1)

org.eclipse.digitaltwin.basyx:basyx.submodelrepository-backend MAVEN version =2.0.0-milestone-02, =0.8.0, =2.0.0-milestone-03, =2.0.0-milestone-02, =2.0.0-milestone-02, =2.0.0-milestone-02, =2.0.0-milestone-02, =2.0.0-milestone-02, =2.0.0-milestone-02, =2.0.0-milestone-02, =2.0.0-milestone-09.1...

de.iip-ecosphere.platform:support.aas.basyx2 (>=0.8.0, <=0.8.1), de.iip-ecosphere.platform:support.aas.basyx2.server (>=0.8.0, <=0.8.1) +48 more potentially affected by CVE-2026-7411 via org.eclipse.digitaltwin.basyx:basyx.filerepository-backend (>=2.0.0-milestone-03, <=2.0.0-milestone-09.1)

org.eclipse.digitaltwin.basyx:basyx.filerepository-backend MAVEN version =2.0.0-milestone-03, =0.8.0, =0.8.0, =2.0.0-milestone-03, =2.0.0-milestone-03, =2.0.0-milestone-03, =2.0.0-milestone-03, =2.0.0-milestone-03, =2.0.0-milestone-05, =2.0.0-milestone-03, =2.0.0-milestone-03, =2.0.0-milestone-07...

de.iip-ecosphere.platform:support.aas.basyx2.server (>=0.8.0, <=0.8.1), org.eclipse.digitaltwin.basyx:basyx.aasenvironment-client (>=2.0.0-milestone-05, <=2.0.0-milestone-09.1) +18 more potentially affected by CVE-2026-7411 via org.eclipse.digitaltwin.basyx:basyx.submodelservice-backend (>=2.0.0-milestone-05, <=2.0.0-milestone-09.1)

org.eclipse.digitaltwin.basyx:basyx.submodelservice-backend MAVEN version =2.0.0-milestone-05, =0.8.0, =2.0.0-milestone-05, =2.0.0-milestone-05, =2.0.0-milestone-05, =2.0.0-milestone-05, =2.0.0-milestone-05, =2.0.0-milestone-05, =2.0.0-milestone-05, =2.0.0-milestone-05, =2.0.0-milestone-06,...

de.iip-ecosphere.platform:support.aas.basyx2.server (>=0.8.0, <=0.8.1), org.eclipse.digitaltwin.basyx:basyx.aasenvironment-client (>=2.0.0-milestone-03, <=2.0.0-milestone-09.1) +25 more potentially affected by CVE-2026-7411 via org.eclipse.digitaltwin.basyx:basyx.filerepository-backend-inmemory (>=2.0.0-milestone-03, <=2.0.0-milestone-09.1)

org.eclipse.digitaltwin.basyx:basyx.filerepository-backend-inmemory MAVEN version =2.0.0-milestone-03, =0.8.0, =2.0.0-milestone-03, =2.0.0-milestone-03, =2.0.0-milestone-03, =2.0.0-milestone-03, =2.0.0-milestone-03, =2.0.0-milestone-03, =2.0.0-milestone-03, =2.0.0-milestone-03, =2.0.0-milestone-0...

ots has a negative expire override that can bypass its secret retention policy

Summary The /api/create endpoint accepted negative expire query values. For the memory storage backend, negative values were passed to secret creation as a negative duration and treated as no expiry, allowing callers to create secrets that persisted longer than intended. Impact Unauthenticated...

arthexis (>=0.1.3, <=2.0.0), cdm-ecommerce-backend (0.1.0) +67 more potentially affected by CVE-2026-6907 via django (>=5.2.0, <=5.2.13)

django PYPI version =5.2.0, =0.1.3, =8.6.0, =0.32.0, =8.9.21, =0.1.0, =0.1.0, =1.3.0, =0.1.0, =2025.7.0, =2025.7.38 - django-factory-all 0.1.2 and more Source cves: CVE-2026-6907 Source advisory: OSV:PYSEC-2026-55...

CLSA-2026-1777944610 grafana: Fix of CVE-2026-27877

CVE-2026-27877: fix exposure of direct data-source passwords via public dashboards by limiting frontend settings to data sources actually used by the dashboard - Note: upstream test additions in pkg/api/frontendsettingstest.go are not backported. The %check stage only runs the Jest frontend suite...

PT-2026-41410

Summary The /api/create endpoint accepted negative expire query values. For the memory storage backend, negative values were passed to secret creation as a negative duration and treated as no expiry, allowing callers to create secrets that persisted longer than intended. Impact Unauthenticated...

AzuraCast has Path Traversal in `currentDirectory` Parameter that Enables Remote Code Execution via Media Upload

Summary The currentDirectory request parameter in the Flow.js media upload endpoint POST /api/station/stationid/files/upload is not sanitized for path traversal sequences. When combined with a local filesystem storage backend the default, an authenticated user with media management permissions ca...

CI4MS has a Deactivated User Session Bypass (active=0)

Summary The auth filter has the deactivated/banned user check commented out. Details CodeIgniter Shield's loggedIn re-checks the status field catching status='banned', but does not re-check the active field for existing sessions. When an admin deactivates a user active=0 after they have already...

Insufficient Session Expiration

Overview ci4-cms-erp/ci4ms is a composer create-project ci4-cms-erp/ci4ms Affected versions of this package are vulnerable to Insufficient Session Expiration in the session management process. An attacker can retain backend access after their account is deactivated by maintaining an active sessio...

GHSA-4M88-WXJ4-9QJ6 Incus Vulnerable to Panic via Snapshot Bounds Check

Summary Missing validation logic in the storage volume import logic allows an authenticated user with access to Incus' storage volume feature to cause the Incus daemon to crash. Repeated use of this issue can be used to keep Incus offline causing a denial of service. Details The backup restore...

Incus has a Nil-Pointer Dereference Panic via Bucket Metadata

Summary Missing validation logic in the storage bucket import logic allows an authenticated user with access to Incus' storage bucket feature to cause the Incus daemon to crash. Repeated use of this issue can be used to keep Incus offline causing a denial of service. Details The storage bucket...

AZL-86022 CVE-2026-33523 affecting package httpd for versions less than 2.4.67-1

HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend servers. This issue affects Apache HTTP Server: from through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue...

CVE-2026-33523

HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend servers. This issue affects Apache HTTP Server: from through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue...

CVE-2026-33523

The Apache HTTP Server is vulnerable to an HTTP response splitting vulnerability affecting multiple modules when interacting with untrusted or compromised backend servers. This issue impacts versions through 2.4.66 . Successful exploitation could allow an attacker to compromise the confidentialit...

CVE-2026-33523

HTTP response splitting vulnerability in multiple Apache HTTP Server modules with untrusted or compromised backend servers. This issue affects Apache HTTP Server: from through 2.4.66. Users are recommended to upgrade to version 2.4.67, which fixes the issue...

JLSEC-2026-424 curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was...

curl's code for managing SSH connections when SFTP was done using the wolfSSH powered backend was flawed and missed host verification mechanisms. This prevents curl from detecting MITM attackers and more...

JLSEC-2026-433 libcurl supports *pinning* of the server certificate public key for HTTPS transfers

libcurl supports pinning of the server certificate public key for HTTPS transfers. Due to an omission, this check is not performed when connecting with QUIC for HTTP/3, when the TLS backend is wolfSSL. Documentation says the option works with wolfSSL, failing to specify that it does not for QUIC...

cdp-backend (>=3.0.0.dev4, <=3.0.0.dev5) potentially affected by CVE-2026-7725 via prefect (0.14.22)

prefect PYPI version 0.14.22 is affected by a known vulnerability. The following packages have a transitive dependency on prefect and may be impacted: - cdp-backend =3.0.0.dev4, =3.0.0.dev5 Source cves: CVE-2026-7725 Source advisory: OSV:GHSA-6RCX-55R6-JX65...