EUVD-2026-82992

PLANET IGS-5225-8P2T4S industrial managed switch V1 and V2 firmware versions before 1.2412b260707 and 2.2412b260519 use MD5-based password hashing, a cryptographic algorithm with known weaknesses. An attacker who obtains the device configuration file can recover the privileged-mode access passwor...

tomcat: Apache Tomcat: Error condition not handled when configuring CRLs

A flaw was found in Apache Tomcat. When configuring Certificate Revocation Lists CRLs for a FFM presumably a specific type of connector, the system fails to detect and act upon an error condition. This oversight could lead to unexpected behavior or a security bypass, as the intended security...

CVE-2026-61795: Incorrect Comparison

Capsule is a multi-tenancy and policy-based framework for Kubernetes. From 0.13.0 until 0.13.7, hostnameRegexHandler.OnUpdate in internal/webhook/tenant/validation/hostnameregex.go reverses the new and old Tenant parameters and validates the previous AllowedHostnames.Regex instead of the submitte...

How to Configure HTTP Proxy for Veeam Service Provider Console 9.3+

Purpose This article explains how to configure an HTTP proxy for Veeam Service Provider Console 9.3 and later, which introduced a dedicated proxy configuration mechanism that is disabled by default and does not use the WinHTTP, Internet Options, or environment variable proxy settings described in...

PT-2026-95562

Name of the Vulnerable Software and Affected Versions The product name cannot be determined affected versions not specified Description A protection mechanism failure in the object-document mapper's encryption configuration generation allows fields intended for client-side field-level encryption ...

PT-2026-95210

Name of the Vulnerable Software and Affected Versions Deck affected versions not specified Description The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs. This occurs because the system fails to validate whether the user owns or has the...

CVE-2026-77170: Improper Access Control

The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board...

CVE-2026-93763: Cleartext Storage of Sensitive Information

A protection mechanism failure in the object-document mapper's encryption configuration generation can cause fields that an application declared for client-side field-level encryption to be written and kept in cleartext, without any error or warning. A party holding ordinary read access to the...

CVE-2026-76154

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin...

EUVD-2026-65212

Grav: The system, site, and theme Twig variables bypass the content sandbox entirely and are never covered by configdeniedpaths...

CVE-2026-76154

A stored cross-site scripting vulnerability in Grafana's Geomap panel (MapLibre base layer) allows a user with the Editor role to host a malicious style configuration , executing arbitrary JavaScript in another user's session and enabling privilege escalation to Org Admin . The CVSS v3.1 score is...

CVE-2026-76154 CVE-2026-76154 CVE Record

A stored cross-site scripting vulnerability in the Geomap panel's MapLibre base layer allows a user with the Editor role to execute arbitrary JavaScript in another user's session by hosting a malicious style configuration, enabling escalation to Org Admin...

CVE-2026-54237 Wavelog: Unauthenticated Remote Code Execution

Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interfaceassets/triggers.php after installation without an installation lock or permission check. Unsanitized input reaches writeconfig and writeconfigfile in...

OPENSUSE-SU-2026:21873-1 Security update for opensc

This update for opensc fixes the following issues: - CVE-2026-10275: global buffer overflow during key pair generation tests due to missing input validation bsc1267246. - CVE-2026-40528: stack and heap buffer overrun in the dokeyvalue function due to missing length check allows for memory...

EUVD-2026-57010

Kestra: Unauthenticated management/actuator endpoints exposed on port 8081 /env, /loggers bypass API basic-auth...

EUVD-2026-80817

RabbitMQ amqp091-go: Connection Configuration Overwrite via Unsanitized TLS Path Parameter Injection...

SUSE CVE-2026-77404

RabbitMQ amqp091-go is a Go AMQP 0.9.1 client. Prior to 1.13.0, URI.String in uri.go concatenates CertFile, KeyFile, CACertFile, and ServerName values directly into an AMQPS query string instead of encoding them as URL query parameters with url.Values. If an application accepts a TLS asset path...

PYSEC-2026-4012 virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

pyvenv.cfg is a line-based format with no escape syntax. PyEnvCfg.write wrote values verbatim, while PyEnvCfg.readvalues parses the file with str.splitlines. A value containing a line boundary therefore became additional configuration lines, and because reading is last-wins, the injected keys...

virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

pyvenv.cfg is a line-based format with no escape syntax. PyEnvCfg.writewrote values verbatim, while PyEnvCfg.readvalues parses the file withstr.splitlines. A value containing a line boundary therefore becameadditional configuration lines, and because reading is last-wins, the injectedkeys replace...

tomcat: Apache Tomcat: Insufficient documentation for EncryptInterceptor may lead to insecure configurations

A flaw was found in Apache Tomcat. Insufficient technical documentation regarding the secure configuration of the EncryptInterceptor component may lead to deployments with insecure settings. This vulnerability could allow an attacker to exploit misconfigurations that arise from unclear guidance,...