CVE-2026-105891: Missing Authorization

Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1...

CVE-2026-105893: Authorization Bypass Through User-Controlled Key

Authorization Bypass Through User-Controlled Key vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Manipulating User-Controlled Variables.This issue affects Event Tickets: from n/a through 5.30.0.1...

CVE-2026-105888: Missing Authorization

Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1...

CVE-2026-83947: Missing Authorization

Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network...

CVE-2026-107394: Server-Side Request Forgery (SSRF)

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, the previous fix for CVE-2026-25738 did not cover an edge case, allowing an event organizer to submit a crafted URL that points to a prohibited local target but is...

CVE-2026-107391: Uncontrolled Resource Consumption

music-metadata is a metadata parser for audio and video media files. In the public development revision introduced after 11.14.0, a development-branch regression in the MP4 stsd sample-description parser allows an attacker-controlled sample-entry size of zero to prevent the StsdAtom.get cursor fr...

CVE-2026-107397: Improper Neutralization of Input During Web Page Generation

Indico is an event management system that uses Flask-Multipass, a multi-backend authentication system for Flask. Prior to 3.3.13, users who can create content, including speakers who can create minutes, can store crafted HTML in event minutes. When concurrent edits are made to the same minutes, t...

PT-2026-107927

Name of the Vulnerable Software and Affected Versions Event Tickets versions prior to 5.30.0.1 Description Missing authorization allows the exploitation of incorrectly configured access control security levels. Recommendations Update Event Tickets to version 5.30.0.1 or later...

PT-2026-108299

Name of the Vulnerable Software and Affected Versions Azure Event Grid affected versions not specified Description Missing authorization in Azure Event Grid allows an authorized attacker to perform spoofing over a network. Recommendations At the moment, there is no information about a newer versi...

PT-2026-108045

Name of the Vulnerable Software and Affected Versions Pydantic AI versions 1.77.0 through 1.107.5 Pydantic AI versions prior to 2.44.0 Description The local web fetch tool and the WebFetch local fallback process server-controlled responses using operations that grow quadratically relative to the...

PT-2026-108199

Name of the Vulnerable Software and Affected Versions Indico versions prior to 3.3.13 Description Users with content creation privileges, such as speakers capable of creating minutes, can store crafted HTML within event minutes. When concurrent edits occur on the same minutes, the minute editor...

KLA91325 Multiple vulnerabilities in Microsoft Azure

Multiple vulnerabilities were found in Microsoft Azure. Malicious users can exploit these vulnerabilities to bypass security restrictions, execute arbitrary code, gain privileges, obtain sensitive information, spoof user interface. Below is a complete list of vulnerabilities: 1. An elevation of...

com.github.cycladessoa.nyxlets:exec (>=1.0.0.1, <=1.0.0.14), com.github.cycladessoa.nyxlets:log (>=1.0.0.3, <=1.0.0.31) +8 more potentially affected by CVE-2026-106122 via com.rabbitmq:amqp-client (2.8.6)

com.rabbitmq:amqp-client MAVEN version 2.8.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.rabbitmq:amqp-client and may be impacted: - com.github.cycladessoa.nyxlets:exec =1.0.0.1, =1.0.0.3, =1.0.0.1, =1.0.0.3, =1.0.0.2, =1.0.0.1, =1.0.0.3,...

Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates

Impact Deployments using event-driven updates in the Bitbucket Server catalog provider may ingest catalog locations from repositories that are excluded by the provider's configured project, repository, or archived-repository filters. An authenticated Bitbucket Server user who can push to a...

GHSA-C36C-CF6R-GHGJ Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates

Impact Deployments using event-driven updates in the Bitbucket Server catalog provider may ingest catalog locations from repositories that are excluded by the provider's configured project, repository, or archived-repository filters. An authenticated Bitbucket Server user who can push to a...

EUVD-2026-93992

Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates...

EUVD-2026-93569

Quasar Framework: Super-linear regex backtracking on User-Agent lets one request stall a Quasar SSR server...

EUVD-2026-94314

MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified. When a user edits an existing event and changes its distribution or sharinggroupid, the internal before-save hook...

CVE-2026-107175 MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes

MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified. When a user edits an existing event and changes its distribution or sharinggroupid, the internal before-save hook...

CVE-2026-107175 MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes

MISP contains a defect in its event save workflow that prevents the correlation engine from recalculating correlations when an event's distribution level or sharing group is modified. When a user edits an existing event and changes its distribution or sharinggroupid, the internal before-save hook...