CVE-2026-27965

Vitess is a database clustering system for horizontal scaling of MySQL. Prior to versions 23.0.3 and 22.0.4, anyone with read/write access to the backup storage location e.g. an S3 bucket can manipulate backup manifest files so that arbitrary code is later executed when that backup is restored...

PT-2026-22414

Name of the Vulnerable Software and Affected Versions Gradio versions prior to 6.6.0 Description Gradio is a Python package for rapid prototyping. A flaw exists in the OAuth flow where the redirect to target function does not properly validate the target url query parameter. This allows redirecti...

Xerox FreeFlow Core 安全漏洞

Xerox FreeFlow Core is a flexible and easy-to-use software developed by Xerox Corporation. Versions of Xerox FreeFlow Core 8.0.7 and earlier contain security vulnerabilities. These vulnerabilities stem from XML external entity vulnerabilities, which could allow malicious users to execute...

PT-2026-22315

Name of the Vulnerable Software and Affected Versions Xerox FreeFlow Core versions up to and including 8.0.7 Description An XML External Entity XXE issue allows a malicious user to perform Server-Side Request Forgery SSRF by submitting specially crafted XML input that includes malicious external...

Gradio 输入验证错误漏洞

Gradio is an open-source Python library developed by Google. It provides a user-friendly web interface for demonstrating machine learning models. Prior to version 6.6.0, Gradio had a vulnerability related to input validation. This vulnerability stemmed from the redirecttotarget function in the...

DatoCMS 安全漏洞

DatoCMS is an open-source content management system developed by DatoCMS. Versions of DatoCMS prior to v1.0.31 contained security vulnerabilities. These vulnerabilities were caused by iframe injection during authentication processes, which could lead to the loading of arbitrary external resources...

PT-2026-22341

Authenticated Iframe Injection in Dato CMS Web Previews plugin. This vulnerability permits a malicious authenticated user to circumvent the restriction enforced on the configured frontend URL, enabling the loading of arbitrary external resources or origins. This issue affects Web Previews v1.0.31...

EUVD-2026-8818

Vitess users with backup storage access can gain unauthorized access to production deployment environments...

CVE-2026-21902

An Incorrect Permission Assignment for Critical Resource vulnerability in the On-Box Anomaly detection framework of Juniper Networks Junos OS Evolved on PTX Series allows an unauthenticated, network-based attacker to execute code as root. The On-Box Anomaly detection framework should only be...

CVE-2026-28219

creationtimestamp| type| source ---|---|--- 2026-02-26 22:27:53+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mfsaku6hvd2o...

GHSA-Q9HV-HPM4-HJ6X vulnerabilities

Vulnerabilities for packages: helm-push, q, crossplane, xeol, gitaly, crossplane-provider-aws-cloudformation, gitlab-runner, terraform-provider-azurerm, nfpm, kubevela, flux-kustomize-controller, boring-registry, actions-runner-controller, crossplane-provider-aws-kinesis,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: helm-push, q, crossplane, xeol, gitaly, crossplane-provider-aws-cloudformation, gitlab-runner, terraform-provider-azurerm, nfpm, kubevela, flux-kustomize-controller, boring-registry, actions-runner-controller, crossplane-provider-aws-kinesis,...

CVE-2026-1229 vulnerabilities

Vulnerabilities for packages: vcluster, omnictl-multiarch, terraform-provider-pagerduty, apko, dagger, argo-rollouts-fips, flux-notification-controller-fips, crossplane-provider-aws-route53, crossplane-provider-aws-route53-fips, gptscript, cert-manager-cmctl-fips, kubevela-fips,...

Important: Red Hat Security Advisory: Red Hat OpenShift API for Data Protection

A new version of OpenShift API for Data Protection OADP is now available. OpenShift API for Data Protection OADP enables you to back up and restore application resources, persistent volume data, and internal container images to external backup storage. OADP enables both file system-based and...

MAL-2026-1046 Malicious code in jest-param-validator (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 92f5050070ee0637ff34403bfa22fe7464561a421a99410e084c74e1bd023b08 The package jest-param-validator was found to contain malicious code. Source: ghsa-malware...

CVE-2026-1698

A HTTP Host header attack vulnerability affects WebClient and the WebScheduler web apps of PcVue in version 15.0.0 through 16.3.3 included, allowing a remote attacker to inject harmful payloads that manipulate server-side behavior. This vulnerability only affects the endpoints...

CVE-2026-1698 HTTP Host header vulnerability in WebClient and WebScheduler web apps

A HTTP Host header attack vulnerability affects WebClient and the WebScheduler web apps of PcVue in version 15.0.0 through 16.3.3 included, allowing a remote attacker to inject harmful payloads that manipulate server-side behavior. This vulnerability only affects the endpoints...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via manipulation of backup manifest files. An attacker can execute arbitrary commands in the production deployment environment by restoring a crafted backup. Workaround This vulnerability can be mitigated by specifying...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection via manipulation of backup manifest files. An attacker can execute arbitrary commands in the production deployment environment by restoring a crafted backup. Workaround This vulnerability can be mitigated by specifying...

XML External Entity (XXE)

biopython is vulnerable to XML External Entity XXE. The vulnerability is due to improper handling of XML doctype declarations, which allows an attacker to inject malicious external entities and potentially read local files or access internal resources...