EUVD-2026-102479

TaskingAI through 0.3.0 contains a server-side request forgery vulnerability that allows authenticated attackers to make the backend send arbitrary HTTP requests by supplying an unvalidated OpenAPI servers0.url in a user-defined action. Attackers holding a project API key or console admin login c...

PT-2026-116009

B3log Solo through 4.4.0 contains a missing authorization vulnerability in ArticleConsole that allows authenticated authors to access other authors' articles by omitting per-author ownership checks. Attackers can query the console articles status endpoint to list other authors' drafts, probe draf...

CVE-2026-111329

JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant...

CVE-2026-111330

JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through database access or backups can crack console passwords using...

CVE-2026-111330 JuggleIM im-server through 1.8.16 Weak Password Hashing via Unsalted SHA-1

JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through database access or backups can crack console passwords using...

CVE-2026-111329

The JuggleIM im-server (versions through 1.8.16 ) contains a critical vulnerability where it ships with default administrator credentials (admin/123456). This allows unauthenticated remote attackers to access the admin console on port 8090 . Once authenticated, attackers can control tenant applic...

CVE-2026-111330

JuggleIM im-server versions through 1.8.16 are vulnerable to a weak password hashing vulnerability. The application uses unsalted SHA-1 digests (via tools.SHA1) to store admin console passwords in the services/accountservice.go component. If an attacker gains access to the accounts table through ...

CVE-2026-111329 JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console

JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant...

CVE-2026-111329 JuggleIM im-server through 1.8.16 Default Admin Credentials in Admin Console

JuggleIM im-server through 1.8.16 ships default administrator credentials admin/123456 that allow unauthenticated remote attackers to access the admin console on port 8090. Attackers can log in as administrator, even after account deletion since CheckLogin recreates it, to control tenant...

CVE-2026-111330 JuggleIM im-server through 1.8.16 Weak Password Hashing via Unsalted SHA-1

JuggleIM im-server through 1.8.16 contains a weak password hashing vulnerability that stores admin console passwords as unsalted SHA-1 digests via tools.SHA1 in services/accountservice.go. Attackers who obtain the accounts table through database access or backups can crack console passwords using...

Important: Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.17.28 security, enhancement & bug fix update

Red Hat OpenShift Data Foundation 4.17.28 security, enhancement & bug fix update Red Hat OpenShift Data Foundation 4.17.28 security, enhancement & bug fix update FIXED BUGS: ========== DFBUGS-9380: Backport to odf-4.17.z Backport CA related fixes for NooBaa DFBUGS-7336: Backport to odf-4.17.z 5.2...

Astra Linux – Vulnerability in Linux 5.10, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: vcscreen: The load of the struct vcdata pointer in vcsread was moved to avoid a Use-After-Free UAF condition. After a call to consoleunlock in vcsread, the struct vcdata structure can be freed using vcdeallocate. Therefore, the...

Astra Linux – Vulnerability found in Linux 5.10, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: serial: 8250: Fixed PM usagecount for console handover When the console is enabled, univ8250consolesetup calls serial8250consolesetup before .dev is set to uartport. As a result, pmruntimegetsync will not be called. Later, when t...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: s390/sclp: Added a check for the return value of getzeroedpage. Also, added a check for the return value of getzeroedpage in sclpconsoleinit to prevent null pointer dereferencing. Furthermore, to address the memory leak caused by...

Astra Linux – Vulnerability in Thunderbird, Firefox

Regular expressions used to filter out forbidden properties and values from style directives in calls to console.log did not account for external URLs. As a result, data could potentially be exfiltrated from the browser. This vulnerability affects Firefox 109, Firefox ESR 102.7, and Thunderbird...

Important: Red Hat Security Advisory: Red Hat Connectivity Link component - rhcl-operator security update

New rhcl-1/wasm-shim-rhel9, rhcl-1/rhcl-console-plugin, rhcl-1/rhcl-operator and rhcl-1/rhcl-operator-bundle container images are now available in the Red Hat container registry. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scorin...

CVE-2026-110909

Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console al...

CVE-2026-110909

Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console al...

EUVD-2026-101817

Wheels CLI through 4.1.0 does not verify that the local development server answering its HTTP requests belongs to the current project. A process listening on a port targeted by the CLI can receive the project's reload password and code submitted through wheels reload or wheels console; console al...

PT-2026-114443

Name of the Vulnerable Software and Affected Versions Wheels CLI versions prior to 4.1.1 Description The software fails to verify that the local development server responding to HTTP requests is associated with the current project. A malicious process listening on a targeted local port can...