Grav: Twig sandbox config exfiltration via grav.offsetGet + dump filter (CVE-2026-44738 bypass)

Summary The Twig content sandbox replaces config with the redacted SandboxConfig facade and strips Config::get/toArray from the method allowlist GHSA-j274-39qw-32c9, so editor content can't read config secrets via config. That's bypassable: grav is the raw container, offsetget is allow-listed on...

GHSA-CPJF-6666-R8FX link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897

The existing advisory GHSA-4gp8-rjrq-ch6q / CVE-2026-43897 states that the SSRF issue was fixed in 4.0.1. However, 4.0.3 remains bypassable when the documented resolveDNSHost mitigation is used. Root cause: The library validates one resolved IP address through resolveDNSHost, but later performs...

NPM: link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897

NPM: link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897 vulnerability discovered by ? in WordPress Npm link-preview-js versions = 4.0.3...

CVE-2026-63385 affecting package libevent for versions less than 2.1.13-1

CVE-2026-63385 affecting package libevent for versions less than 2.1.13-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-63388 affecting package libevent for versions less than 2.1.13-1

CVE-2026-63388 affecting package libevent for versions less than 2.1.13-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-63381 affecting package libevent for versions less than 2.1.13-1

CVE-2026-63381 affecting package libevent for versions less than 2.1.13-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-63383 affecting package libevent for versions less than 2.1.13-1

CVE-2026-63383 affecting package libevent for versions less than 2.1.13-1. An upgraded version of the package is available that resolves this issue...

CVE-2026-76098 affecting package python-mistune for versions less than 3.3.4-1

CVE-2026-76098 affecting package python-mistune for versions less than 3.3.4-1. An upgraded version of the package is available that resolves this issue...

CLSA-2026-1788376116 TuxCare security update for org.springframework (6 CVEs)

TuxCare rebuilt 22 org.springframework packages to address 6 CVEs. Fixed in 5.1.6.RELEASE-tuxcare.4...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana13.2: grafana13.2-13.2.0-0.1.4.hum1 aarch64, x8664 grafana13.2-13.2.0-0.1.4.hum1.src src Security Fixes: grafana13.2: CVE-2026-84375...

GO-2026-6306 Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0 in code.vikunja.io/api

Vikunja has an incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parentprojectid=0 in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs Security Update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: grafana12.4: grafana12.4-12.4.9-0.5.hum1 aarch64, x8664 grafana12.4-12.4.9-0.5.hum1.src src Security Fixes: grafana12.4: CVE-2026-84375...

CLSA-2026-1788373352 TuxCare security update for postcss (2 CVEs)

TuxCare rebuilt postcss to address 2 CVEs. Fixed in 8.4.5-tuxcare.3...

CLSA-2026-1788373105 TuxCare security update for org.springframework (2 CVEs)

TuxCare rebuilt 25 org.springframework packages to address 2 CVEs. Fixed in 6.0.13-tuxcare.2...

Important: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: ruby3.4: ruby3.4-3.4.10-31.7.hum1 aarch64, x8664 ruby3.4-bundled-gems-3.4.10-31.7.hum1 aarch64, x8664 ruby3.4-default-gems-3.4.10-31.7.hum1 noarch ruby3.4-devel-3.4.10-31.7.hum1 aarch64, x8664...

Low: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: ruby3.4: ruby3.4-3.4.10-31.7.hum1 aarch64, x8664 ruby3.4-bundled-gems-3.4.10-31.7.hum1 aarch64, x8664 ruby3.4-default-gems-3.4.10-31.7.hum1 noarch ruby3.4-devel-3.4.10-31.7.hum1 aarch64, x8664...

Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: podman: podman-6.0.2-2.3.hum1 aarch64, x8664 podman-docker-6.0.2-2.3.hum1 noarch podman-machine-6.0.2-2.3.hum1 aarch64, x8664 podman-remote-6.0.2-2.3.hum1 aarch64, x8664 podmansh-6.0.2-2.3.hum1...

CVE-2026-79756

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...

CVE-2026-79756 Nuclio: Unauthenticated OS command injection via namespace header in list-all resource path on local platform

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...

EUVD-2026-70219

Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.17.4, the fix for unauthenticated OS command injection in the nuclio dashboard on the local/Docker platform is incomplete. The fix added validateFunctionName for function names and common.Quote for the...