CVE-2026-81931

Roskus Prospero Flow CRM before 5.16.0 is affected by an unrestricted file upload in the product photo feature. The validation logic checks only magic bytes and blocks a fixed list of PHP extensions , but ProductSaveController::save() stores the file using the client-supplied extension in the pub...

CVE-2026-81931 Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting

Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission routine Seller role to execute arbitrary JavaScript in the application origin. The photo validation rule...

CVE-2026-81931 Unrestricted upload of file with dangerous type in Prospero Flow CRM product photo allows stored cross-site scripting

Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission routine Seller role to execute arbitrary JavaScript in the application origin. The photo validation rule...

EUVD-2026-67088

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.10 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect outbound model requests to an...

SUSE CVE-2026-79033

Insufficient control flow management in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially execute arbitrary code inside the sandbox via a crafted HTML page. Chromium security severity: Medium...

PT-2026-82552

Name of the Vulnerable Software and Affected Versions GitLab AI Gateway versions 18.10 through 19.0.12 GitLab AI Gateway versions 19.1 through 19.1.7 GitLab AI Gateway versions 19.2 through 19.2.2 Description An authenticated user with Duo Agent Platform access can redirect outbound model request...

CVE-2026-81931: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission routine Seller role to execute arbitrary JavaScript in the application origin. The photo validation rule...

PT-2026-82753

Unrestricted Upload of File with Dangerous Type in the product photo upload in Roskus Prospero Flow CRM before 5.16.0 allows an authenticated user holding the create product permission routine Seller role to execute arbitrary JavaScript in the application origin. The photo validation rule...

ROS-20260827-73-0041

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-75411

JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the SecurityCheck class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely...

CVE-2026-79033

A flaw was found in Chromium's DevTools. A remote attacker, leveraging social engineering, could exploit insufficient control flow management by enticing a user to open a crafted HTML page. This could potentially lead to the execution of arbitrary code within the browser's sandbox...

CVE-2026-74746

In the Linux kernel, the following vulnerability has been resolved: netfilter: flowtable: publish GC-visible tuple last nfflowtableiterate only treats original-direction tuple nodes as owning entries. Publishing the original node first lets GC observe and free a flow while flowoffloadadd is still...

EUVD-2026-66747

JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the SecurityCheck class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely...

Linux Distros Unpatched Vulnerability : CVE-2026-79033

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Insufficient control flow management in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098822)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098822 advisory. In the Linux kernel, the following vulnerability has been resolved: net/sched: clsflow: fix NULL pointer dereference on shared blocks flowchange calls tcfblockq and...

CVE-2026-75411

JeecgBoot v3.9.2 is vulnerable to Remote command execution via the CodeNode component of the AI Flow module. The component supports Groovy script execution , but the SecurityCheck class uses a blacklist mechanism that can be completely bypassed due to the dynamic nature of Groovy, specifically th...

PT-2026-82304

Name of the Vulnerable Software and Affected Versions JeecgBoot version 3.9.2 Description Remote command execution is possible in the CodeNode component of the AI Flow module, which supports Groovy script execution. The SecurityCheck class uses a blacklist to intercept dangerous calls; however,...

ROS-20260826-73-0020

The vulnerability in the kernel-lt is related to the implementation of an incorrect control flow. Exploiting this vulnerability can allow an attacker to cause a service failure...

CVE-2026-75411: Improper Control of Generation of Code

JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the SecurityCheck class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely...

CVE-2026-75411

JeecgBoot v3.9.2 is vulnerable to Remote command execution. The CodeNode component of the AI Flow module supports Groovy script execution. While the SecurityCheck class employs a blacklist mechanism to intercept dangerous calls, the dynamic nature of Groovy allows this blacklist to be completely...