[SECURITY] [DLA 4809-1] nodejs security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4809-1 [email protected] https://www.debian.org/lts/security/ Bastien Roucariès October 01, 2026 https://wiki.debian.org/LTS -...

EUVD-2026-90872

Next.js versions from 16.3.0 to 16.3.7 warm use cache handlers using next/root-params and can leak their return value to pages with different root params. With Cache Components enabled cacheComponents: true, a 'use cache' function that calls another 'use cache' function that reads a root param ca...

SiYuan discloses an administrator's open documents and search terms to anonymous readers

Summary /api/system/getConf serves Conf.UILayout to publish readers after passing it through FilterConfByPublishIgnore, whose only function is to filter that layout. The layout is written exclusively by setUILayout, which is administrator-gated, so what readers receive is the administrator's own...

EUVD-2026-57448

SiYuan discloses an administrator's open documents and search terms to anonymous readers...

GHSA-HGFG-J9PG-43XW SiYuan discloses an administrator's open documents and search terms to anonymous readers

Summary /api/system/getConf serves Conf.UILayout to publish readers after passing it through FilterConfByPublishIgnore, whose only function is to filter that layout. The layout is written exclusively by setUILayout, which is administrator-gated, so what readers receive is the administrator's own...

CVE-2026-79899

Fortra BoKS Manager contains an insecure temporary file vulnerability in the bccgethostcert utility. The root cause is the creation of predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master with read access to files under BOKS_tmp may obtain CA secr...

CVE-2026-66248

iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigger verbose database and system errors, enabling the disclosure of sensitive internal infrastructure details used to plan advanced targeted attacks...

CVE-2018-18778

CVE-2018-18778 - ACME minihttpd Arbitrary File Read CVE-2018-18778 is a security vulnerability affecting ACME minihttpd a lightweight web server. The vulnerability allows remote attackers to read arbitrary files on the server. It was publicly disclosed in October 2018 and impacts versions of...

CVE-2026-66249 HCL iControl is affected by a Missing Secure Attribute vulnerability

iControl is affected by a Missing Secure Attribute vulnerability, which could allow an attacker to intercept cookies transmitted over unencrypted HTTP connections, enabling the unauthorized extraction of sensitive information such as session identifiers...

CVE-2026-66248 HCL iControl is affected by an Improper Error Handling vulnerability

iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigger verbose database and system errors, enabling the disclosure of sensitive internal infrastructure details used to plan advanced targeted attacks...

CVE-2026-66248

The HCL iControl software is affected by an Improper Error Handling vulnerability. This flaw could allow an unauthenticated attacker to trigger verbose database and system errors. Such errors may disclose sensitive internal infrastructure details , which could be leveraged to plan advanced target...

EUVD-2026-90815

iControl is affected by an Improper Error Handling vulnerability, which could allow an unauthenticated attacker to trigger verbose database and system errors, enabling the disclosure of sensitive internal infrastructure details used to plan advanced targeted attacks...

Blackash-CVE-2025-66516

🚨 CVE-2025-66516 — Critical Apache Tika Vulnerability CVSS: 10.0 | Exploit Type: XXE Injection | Risk Level: MAXIMUM 🎯 Executive Summary CVE-2025-66516 is a critical XML External Entity XXE vulnerability in Apache Tika’s core processing engine. A single malicious PDF with XFA content can trigger:...

EUVD-2026-90801

Insertion of Sensitive Information Into Sent Data vulnerability in Shamim Rajani Pie Register pie-register allows Retrieve Embedded Sensitive Data.This issue affects Pie Register: from n/a through 3.8.4.13...

Exploit for CVE-2025-46087

Feysbuk — HEIF Heist Laboratuvarı 🧪 !platformhttps://img.s...

CVE-2026-103858

MISP contains an incomplete authorization check in the discussion posting functionality. When a user submits a post to a thread or replies to an existing post, the application only verified whether the target thread was restricted to a single organization org-only distribution. It did not enforce...

CVE-2026-103336

Insertion of Sensitive Information Into Sent Data vulnerability in Smackcoders Inc. WP Ultimate CSV Importer wp-ultimate-csv-importer allows Retrieve Embedded Sensitive Data.This issue affects WP Ultimate CSV Importer: from n/a through 9.1...

Symlink Attack

Overview tornado is a Python web framework and asynchronous networking library, originally developed at FriendFeed. Affected versions of this package are vulnerable to Symlink Attack via StaticFileHandler.validateabsolutepath in tornado/web.py, which uses os.path.abspath to validate that a...

WordPress Payments for Hubtel plugin < 1.0.2 - Unauthenticated Payment Gateway Credentials Disclosure vulnerability

Unauthenticated Payment Gateway Credentials Disclosure vulnerability discovered by Animesh Gaurav WPScan in WordPress Plugin Payments for Hubtel versions 1.0.2...

CVE-2026-103678 Tnef: heap out-of-bounds read in get_rtf_data_from_buf() via uncompressed rtf mapi value

A flaw was found in tnef. An attacker can exploit this vulnerability by providing a specially crafted file containing uncompressed Rich Text Format RTF data. Because the application fails to properly validate input buffer boundaries before copying data in getrtfdatafrombuf, reading beyond the...