PT-2026-106028

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/workspace slug/download/asset id/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belong...

CVE-2026-105752: Exposure of Sensitive Information to an Unauthorized Actor

vLLM is an inference and serving engine for large language models. Prior to 0.30.0, Harmony tool continuations submitted through "POST /v1/responses" requests rebuild the next-turn engine input without preserving the cachesalt value, placing the continuation prefix in the global unsalted cache...

CVE-2026-105742: Insertion of Sensitive Information Into Sent Data

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.95.0 until 2.132.0, the HTML image resource loader in docling/backend/utils/imageresourceloader.py forwards headers configured through the HTMLBackendOptions.heade...

CVE-2026-105684: Exposure of Sensitive Information to an Unauthorized Actor

Penpot is an open-source design and prototyping platform. Prior to 2.18.0, the get-comment-threads, get-comment-thread, and get-comments RPC commands use check-comment-permissions! but do not apply the share link's pages restriction. A holder of a page-scoped share link can retrieve comment threa...

PT-2026-106031

Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/slug/cycles/ through WorkspaceCyclesEndpoint and GET /api/workspaces/slug/modules/ through WorkspaceModulesEndpoint return records from every project in a workspace without checking whether the requester belongs ...

Debian dla-4823 : roundcube - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4823 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4823-1 [email protected]...

AlmaLinux 9 : osbuild-composer (ALSA-2026:69293)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:69293 advisory. golang.org/x/net/html: golang: golang.org/x/net/html: Cross-Site Scripting via HTML parsing bypass CVE-2026-27136 golang.org/x/net/html:...

Linux Distros Unpatched Vulnerability : CVE-2026-63269

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - LibreOffice can link to audio and video files from a document, and on Linux it plays them with GStreamer. A linked media file could be an HLS playlist that made...

Oracle Linux 10 : kernel (ELSA-2026-71233)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-71233 advisory. - pppoe: reload header pointer after devhardheader Guillaume Nault RHEL-242509 CVE-2026-68121 - nvme-tcp: fix host memory disclosure on R2T for a rea...

Oracle Linux 10 : kernel (ELSA-2026-71602)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-71602 advisory. - pppoe: reload header pointer after devhardheader Guillaume Nault RHEL-242509 CVE-2026-68121 - nvme-tcp: fix host memory disclosure on R2T for a rea...

PT-2026-106015

Plane is an open-source project management tool. Prior to 1.4.0, aPITokenLogMiddleware logs API keys in plaintext. This allows someone with low privileges to steal user API keys and further escalate their privileges. This issue is fixed in 1.4.0...

PT-2026-106217

Name of the Vulnerable Software and Affected Versions Penpot versions prior to 2.18.0 Description An issue exists where the get-page RPC Remote Procedure Call accepts a share-link permission object providing broad read access but fails to verify if the requested page-id is among the pages...

PT-2026-106144

In multiple functions of rw t5t.cc, there is a possible out-of-bounds read due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...

PT-2026-104703

Name of the Vulnerable Software and Affected Versions Modem affected versions not specified Description A logic error in Modem allows for local information disclosure. This issue can be exploited without requiring user interaction or additional execution privileges. Recommendations At the moment,...

CVE-2026-104960: Authorization Bypass Through User-Controlled Key

Plane is an open-source project management tool. Prior to 1.4.0, Plane exposes the workspace-scoped GET /api/assets/v2/workspaces/workspaceslug/download/assetid/ endpoint for project-bound FileAsset objects without enforcing access to the asset's owning project. An authenticated user who belongs ...

CVE-2026-105748: External Control of File Name or Path

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.16.0 until 2.131.0, the InputFormat.JSONDOCLING backend in docling/backend/json/doclingjsonbackend.py validates serialized DoclingDocument input without rejecting...

PT-2026-104728

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Dynamic Client Registration flow of the Keycloak identity and access management server. The registration process fails to filter security-sensitive client attributes...

CVE-2026-105699: Authorization Bypass Through User-Controlled Key

Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.6.8 until 1.9.1, Langflow authenticated access to the project identifier in a project-scoped MCP connection but did not authorize the resource URI supplied to resources/read. readresource forwarded the...

PT-2026-104814

LibreOffice Calc can link a cell range to an external csv data source, and the link is saved in the document. Such a link was fetched while the document loaded, so opening a document could read a local file into the sheet, or make a request to a host of the document's choosing. In fixed versions...

CVE-2026-105751: Improper Limitation of a Pathname to a Restricted Directory

Docling simplifies document processing by parsing diverse formats and providing integrations with the generative AI ecosystem. From 2.107.0 until 2.120.3, docling/backend/opendocumentbackend.py uses the xlink:href attribute value of a draw:image element as a filesystem path when the referenced pa...