Linux Distros Unpatched Vulnerability : CVE-2026-61700

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9,...

DEBIAN-CVE-2026-77281

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite can pass attacker-controlled replacement bytes through...

CVE-2026-77281

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite can pass attacker-controlled replacement bytes through...

CVE-2026-77281 Caddy: rewrite placeholder re-expansion

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite can pass attacker-controlled replacement bytes through...

CVE-2026-77281 Caddy: rewrite placeholder re-expansion

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite can pass attacker-controlled replacement bytes through...

CVE-2026-77281 Caddy: rewrite placeholder re-expansion

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, three configuration-dependent weaknesses affect the handler and placeholder layer. In modules/caddyhttp/rewrite/rewrite.go, Rewrite.Rewrite can pass attacker-controlled replacement bytes through...

GHSA-47CH-6W46-6XM7 Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content

Summary The mediadirectory Twig function is allow-listed for use in sandboxed, editor-authored page content system/config/security.yaml. Its implementation, GravExtension::mediaDirFunc, only treats the input as unsafe when it looks like a Grav stream user://, theme://, etc. If the input is instea...

Grav: media_directory() Twig function allows filesystem path traversal and file content disclosure from sandboxed page content

Summary The mediadirectory Twig function is allow-listed for use in sandboxed, editor-authored page content system/config/security.yaml. Its implementation, GravExtension::mediaDirFunc, only treats the input as unsafe when it looks like a Grav stream user://, theme://, etc. If the input is instea...

GHSA-W3F4-8PJ2-599W Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images

Reported by: Nihad Huseynli @nihaddhuseynli https://github.com/nihaddhuseynli — [email protected] ▎ Note: I attempted to report this via [email protected] first, per SECURITY.md, but the email bounced with 550 5.1.1 Address does not exist. Filing directly here instead. Path Traversal i...

Grav: Path Traversal in ImageMedium::watermark() — arbitrary file disclosure via publicly-cached images

Reported by: Nihad Huseynli @nihaddhuseynli https://github.com/nihaddhuseynli — [email protected] ▎ Note: I attempted to report this via [email protected] first, per SECURITY.md, but the email bounced with 550 5.1.1 Address does not exist. Filing directly here instead. Path Traversal i...

Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure

Summary Grav CMS's blueprint dynamic-field callable guard can be bypassed with a fully-qualified Class::method string, letting an account with only page-editing rights admin.pages, not super-admin plant a directive in a page's form-field frontmatter that invokes an arbitrary public static PHP...

GHSA-7PGQ-CR25-XVC8 Grav: Incomplete callable validation in blueprint dynamic fields allows arbitrary static method invocation and file disclosure

Summary Grav CMS's blueprint dynamic-field callable guard can be bypassed with a fully-qualified Class::method string, letting an account with only page-editing rights admin.pages, not super-admin plant a directive in a page's form-field frontmatter that invokes an arbitrary public static PHP...

GHSA-WXMM-Q36W-R9XJ MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests

Summary MariaDB Connector/J does not enforce allowLocalInfile=false when processing server-initiated LOCAL INFILE requests protocol packet type 0xfb. However, exploitation is constrained: the server can only request the exact filename the client already included in its LOAD DATA LOCAL INFILE quer...

CVE-2026-61700

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, ClientMessage.readPacket processes a server-initiated LOCAL INFILE protocol packet 0xfb without enforcing allowLocalInfile=false. When an application sen...

CVE-2026-61700 MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, ClientMessage.readPacket processes a server-initiated LOCAL INFILE protocol packet 0xfb without enforcing allowLocalInfile=false. When an application sen...

CVE-2026-61700

MariaDB Connector/J (Java driver for MariaDB/MySQL) has a flaw in ClientMessage.readPacket : it processes a server-initiated LOCAL INFILE protocol packet (0xfb) without enforcing the allowLocalInfile=false setting. When an application sends a LOAD DATA LOCAL INFILE query, a rogue or man-in-the-mi...

CVE-2026-61700 MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, ClientMessage.readPacket processes a server-initiated LOCAL INFILE protocol packet 0xfb without enforcing allowLocalInfile=false. When an application sen...

CVE-2026-61700 MariaDB Connector/J does not enforce allowLocalInfile=false on server-initiated LOCAL INFILE requests

MariaDB Connector/J is used to connect applications developed in Java to MariaDB and MySQL databases. Prior to 2.7.14, 3.3.5, 3.4.3, and 3.5.9, ClientMessage.readPacket processes a server-initiated LOCAL INFILE protocol packet 0xfb without enforcing allowLocalInfile=false. When an application sen...

CVE-2026-93013 RAGFlow through 0.27.2 Tenant Import Endpoints Path Traversal

RAGFlow through 0.27.2 contains a path traversal vulnerability in the devinsertchunksfromfile and devinsertmetadatafromfile endpoints that allows authenticated attackers to read arbitrary files by supplying absolute file paths in the filepath parameter. Attackers with valid access tokens can...

CVE-2026-82723 Actor record with password digest stored in AshAuthentication audit log entries

Insertion of Sensitive Information into Log File vulnerability in team-alembic AshAuthentication allows disclosure of user password digests to readers of the audit store. The auditlog add-on builds each entry's extradata in AshAuthentication.AddOn.AuditLog.Auditor.buildextradata/4, which takes...