CVE-2026-86539 knowns through 0.33.0 Server-Side Request Forgery via embedding-models endpoint

knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport...

CVE-2026-86539 knowns through 0.33.0 Server-Side Request Forgery via embedding-models endpoint

knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport...

CVE-2026-86441

Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Several organisation-related widgets did not honor Security.hideorganisationindexfromusers. As a result, authenticated users without the permsharinggroup permission...

CVE-2026-86441 MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data

Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Several organisation-related widgets did not honor Security.hideorganisationindexfromusers. As a result, authenticated users without the permsharinggroup permission...

EUVD-2026-72374

Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Several organisation-related widgets did not honor Security.hideorganisationindexfromusers. As a result, authenticated users without the permsharinggroup permission...

CVE-2026-86441 MISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data

Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Several organisation-related widgets did not honor Security.hideorganisationindexfromusers. As a result, authenticated users without the permsharinggroup permission...

EUVD-2026-72365

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...

PT-2026-89673

Name of the Vulnerable Software and Affected Versions strongSwan versions 5.0.2 through 6.0.7 Description The openssl plugin allows PKCS7 certificate enumeration, which results in a memory leak where memory is not released after its effective lifetime. Recommendations At the moment, there is no...

PT-2026-86751

The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated attackers, with contributor-level access a...

PT-2026-86771

Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Several organisation-related widgets did not honor Security.hide organisation index from users. As a result, authenticated users without the perm sharing group...

CVE-2026-86441: Missing Authorization

Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Several organisation-related widgets did not honor Security.hideorganisationindexfromusers. As a result, authenticated users without the permsharinggroup permission...

PT-2026-86932

knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport...

CVE-2026-86539: Server-Side Request Forgery (SSRF)

knowns through 0.33.0 contains a server-side request forgery vulnerability in the POST /api/embedding-models/test endpoint that issues outbound requests to caller-supplied destinations without validation. Attackers can enumerate internal hosts and cloud metadata endpoints by observing transport...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053409)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053409 advisory. In the Linux kernel, the following vulnerability has been resolved: xhci: Fix Panther point NULL pointer deref at full-speed re-enumeration re-enumerating full-speed...

CVE-2026-86191 SiYuan before v3.8.2 Private Attribute View Key Enumeration

SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve comple...

CVE-2026-86191

SiYuan versions before v3.8.2 are affected by an information disclosure vulnerability in the getAttributeViewKeysByID endpoint. The root cause is that publish readers can enumerate private attribute view key definitions without the system verifying parent database visibility, allowing attackers t...

CVE-2026-86191 SiYuan before v3.8.2 Private Attribute View Key Enumeration

SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve comple...

CVE-2026-86191 SiYuan before v3.8.2 Private Attribute View Key Enumeration

SiYuan versions before v3.8.2 contain an information disclosure vulnerability in the getAttributeViewKeysByID endpoint that allows publish readers to enumerate private attribute view key definitions without verifying parent database visibility. Attackers can access the endpoint to retrieve comple...

CVE-2026-86178

Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author...

CVE-2026-86178 Pixelfed through 0.12.9 Unauthorized Story Access via API

Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access follower-only stories. Attackers can enumerate sequential story IDs and submit reactions or comments to retrieve story media URLs and author...