CVE-2026-45099

Terragrunt (an orchestration tool for OpenTofu/Terraform) prior to v1.0.4 is vulnerable to arbitrary file deletion via a maliciously crafted .terragrunt-module-manifest file in a downloaded external module. The root cause is that fileManifest.Clean() in internal/util/file.go trusted decoded paths...

CVE-2026-45099 Terragrunt: Arbitrary File Deletion via Malicious Module Manifest

Terragrunt is a flexible orchestration tool that allows Infrastructure as Code written in OpenTofu or Terraform to scale. Prior to 1.0.4, Terragrunt trusts paths decoded from a downloaded module's .terragrunt-module-manifest during fileManifest.Clean in internal/util/file.go. A malicious or...

EUVD-2026-63572

A flaw was found in Submariner. This vulnerability allows a malicious cluster spoke to redirect network traffic from other connected clusters peer clusters by publishing a specially crafted network endpoint. The system fails to properly validate the network subnets provided by the malicious...

CVE-2026-66785

A flaw was found in Submariner. This vulnerability allows a malicious cluster spoke to redirect network traffic from other connected clusters peer clusters by publishing a specially crafted network endpoint. The system fails to properly validate the network subnets provided by the malicious...

CVE-2026-54449

LangBot is a global IM bot platform designed for LLMs. In version 4.10.7 and earlier, any authenticated user can add or change an STDIO MCP server configuration without an adequate authorization boundary. In src/langbot/pkg/provider/tools/loaders/mcp.py, StdioServerParameters accepts the configur...

CVE-2026-66785: Insufficient Verification of Data Authenticity

A flaw was found in Submariner. This vulnerability allows a malicious cluster spoke to redirect network traffic from other connected clusters peer clusters by publishing a specially crafted network endpoint. The system fails to properly validate the network subnets provided by the malicious...

CVE-2026-9033: Missing Authentication for Critical Function

An unauthenticated attacker with network access to the captive portal service of an affected device can terminate active captive portal sessions, including forcing logout of specific users or clearing all active sessions. Affected users must re-authenticate to regain access. Successful...

PT-2026-79191

Name of the Vulnerable Software and Affected Versions BigBlueButton versions prior to 3.0.29 Description Presenters can submit a presentationId through the '/api/graphql' endpoint that identifies a presentation belonging to a different meeting. The RemovePresentationPubMsgHdlr.scala function fail...

CVE-2026-76336

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete all Search Processing Language 2 SPL2 modules across all apps and users on the instance through the SPL2 module management Representational State Transfer REST API. Thi...

CVE-2026-76336

Splunk Enterprise versions below 10.4.2 (mainline) and 10.2.6 (LTS) are affected: the SPL2 module management REST API lacks sufficient authorization and validation on module deletion, letting any non-admin/non-power user delete all SPL2 modules instance-wide, wiping exported datasets/functions, c...

CVE-2026-44254 Wazuh: Stack Out-of-Bounds Write in remoted Decompression Path

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 1.0.0 until 4.14.6 and 5.0.0-beta2, HandleSecureMessage in src/remoted/secure.c passes a pointer inside its stack buffer to ReadSecMSG, and src/oscrypto/shared/msgs.c decompresses up to OSMAXSTR byt...

EUVD-2026-62552

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 3.9.0 until 4.14.5 and 5.0.0-beta2, the Wazuh cluster protocol in framework/wazuh/core/cluster/common.py allows an authenticated cluster node to exhaust memory on the master. The receivestr method...

CVE-2026-76336: Missing Authorization

In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete all Search Processing Language 2 SPL2 modules across all apps and users on the instance through the SPL2 module management Representational State Transfer REST API. Thi...

CVE-2026-53542: Improper Neutralization of Special Elements used in an OS Command

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the archive creation endpoint in src/backend/ssh/file-manager.ts passes selected file basenames to tar without an end-of-options marker and without making the operands...

CVE-2026-71308

Netflix Lemur versions 0.5.0 through 1.9.2 accept unauthenticated replaces[] identifiers, allowing an authenticated non-read-only user to silence victim certificate notifications, exclude them from reissue rotation, and substitute attacker-controlled certificates at scale. CVSS 8.1 (HIGH). Fixed ...

EUVD-2026-61152

Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit requests accepted replaces or replacements identifiers that AssociatedCertificateSchema resolved with fetchobjects without a CertificatePermission check. Assigning those objects to...

CVE-2026-61634 RabbitMQ Java client accepts broker frames larger than the negotiated AMQP frame_max

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes. Prior to 5.33.0, the AMQP connection tuning path records the negotiated AMQP framemax value, but src/main/java/com/rabbitmq/client/impl/SocketFrameHandler.java and...

CVE-2026-49228: Authorization Bypass Through User-Controlled Key

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend product operations allow a low-privileged Vendor to access products owned by another Vendor. The admin/controller/product/products.php controller accepts a...

PT-2026-77283

Name of the Vulnerable Software and Affected Versions Lemur versions 0.5.0 through 1.9.2 Description An authenticated non-read-only user can target certificates they do not own or have a role for by using the replaces or replacements identifiers during certificate creation, upload, or edit...

CVE-2026-71308: Authorization Bypass Through User-Controlled Key

Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit requests accepted replaces or replacements identifiers that AssociatedCertificateSchema resolved with fetchobjects without a CertificatePermission check. Assigning those objects to...