CVE-2026-53802

rsync before 3.5.0 contains an arbitrary file read vulnerability that allows attackers to read files accessible to the rsync daemon process by exploiting symlink following in input configuration file handling including --files-from, --password-file, and filter merge files. Attackers can place a...

WordPress Featured Image from URL plugin <= 5.3.3 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by luc in WordPress Plugin Featured Image from URL versions = 5.3.3...

bind: bind9: Cache poisoning via label count discrepancy, RRSIG, wildcards

It is possible for an attacker's zone to respond to a query with an RRSIG that has a smaller number of labels than the zone in which the RRSIG is contained. This causes named to produce a wildcard name for a zone that is shorter than the attacker's zone, which can result in cache poisoning. For...

CVE-2026-72560

A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRFPROTECTIONENABLED is set to false by default. The import-from-URL endpoint fetches any caller-supplied URL including internal loopback addresses on the default installation. An...

CVE-2026-72606 Pinry Pinry - Server-Side Request Forgery

A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the pin-from-URL feature. The feature passes the user-supplied URL directly to requests.get without host o...

EUVD-2026-56045

A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the pin-from-URL feature. The feature passes the user-supplied URL directly to requests.get without host o...

CVE-2026-72606 Pinry Pinry - Server-Side Request Forgery

A server-side request forgery vulnerability in Pinry through 2.1.13 allows unauthenticated remote attackers to make the server issue HTTP requests to arbitrary internal or external hosts via the pin-from-URL feature. The feature passes the user-supplied URL directly to requests.get without host o...

CVE-2026-72560 HumanSignal Label Studio - Server-Side Request Forgery

A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRFPROTECTIONENABLED is set to false by default. The import-from-URL endpoint fetches any caller-supplied URL including internal loopback addresses on the default installation. An...

EUVD-2026-56030

A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRFPROTECTIONENABLED is set to false by default. The import-from-URL endpoint fetches any caller-supplied URL including internal loopback addresses on the default installation. An...

CVE-2026-72560

A server-side request forgery vulnerability in HumanSignal Label Studio through 1.24.0.dev0 exists because SSRFPROTECTIONENABLED is set to false by default. The import-from-URL endpoint fetches any caller-supplied URL including internal loopback addresses on the default installation. An...

PT-2026-70150

Name of the Vulnerable Software and Affected Versions Pinry versions prior to 2.1.14 Description A server-side request forgery SSRF issue exists in the pin-from-URL feature. This occurs because the application passes a user-supplied URL directly to the requests.get function without validating the...

PT-2026-70135

Name of the Vulnerable Software and Affected Versions HumanSignal Label Studio versions prior to 1.24.0.dev0 Description An authenticated user can perform a server-side request forgery SSRF because the SSRF PROTECTION ENABLED variable is set to false by default. This allows the 'import-from-URL'...

CVE-2026-68121

In the Linux kernel, the following vulnerability has been resolved: pppoe: reload header pointer after devhardheader pppoesendmsg saves a pointer to the PPPoE header before calling devhardheader. Device header callbacks are allowed to reallocate the skb head, invalidating pointers into it. This c...

CVE-2026-68179 misc: nsm: only unlock nsm_dev on post-lock error paths

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: only unlock nsmdev on post-lock error paths nsmdevioctl jumps to the common out label even when the initial copyfromuser fails before nsm-lock has been taken. The error path then blindly unlocks a mutex that was never...

CVE-2026-68179

CVE-2026-68179 affects the Linux kernel NSM: nsm_dev_ioctl() may unlock a mutex that was never acquired when pre-lock copy_from_user() fails, risking a local DoS. A patch changes control flow to return immediately on pre-lock failures and to keep the unlock path for post-lock errors only. The vul...

EUVD-2026-55280

In the Linux kernel, the following vulnerability has been resolved: misc: nsm: only unlock nsmdev on post-lock error paths nsmdevioctl jumps to the common out label even when the initial copyfromuser fails before nsm-lock has been taken. The error path then blindly unlocks a mutex that was never...

EUVD-2026-55502

In the Linux kernel, the following vulnerability has been resolved: pppoe: reload header pointer after devhardheader pppoesendmsg saves a pointer to the PPPoE header before calling devhardheader. Device header callbacks are allowed to reallocate the skb head, invalidating pointers into it. This c...

PYSEC-2026-3634 Keras: TorchModuleWrapper can deserialize unsafe PyTorch pickle data

A vulnerability in keras-team/keras version 3.15.0 allows unsafe deserialization of attacker-controlled PyTorch pickle data through the public keras.layers.TorchModuleWrapper.fromconfig method. This method invokes torch.load..., weightsonly=False without requiring an explicit unsafe opt-in, such ...

CVE-2026-19351 dresende node-sql-query Request Parameter Select.js SelectQuery.build sql injection

A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.build in the library lib/Select.js of the component Request Parameter Handler. Performing a manipulation results in sql injection. It is...

EUVD-2026-54919

A vulnerability was found in dresende node-sql-query 0.1.25/0.1.26/0.1.27/0.1.28. Affected by this vulnerability is the function SelectQuery.from/SelectQuery.build in the library lib/Select.js of the component Request Parameter Handler. Performing a manipulation results in sql injection. It is...