CVE-2026-88013 rclone: http backend forwards custom/auth headers to a different host on redirect

rclone is a command-line program to sync files and directories to and from different cloud storage providers. From 1.49.0 until 1.75.1, the HTTP backend attaches headers configured through --http-headers or headers= to requests in backend/http/http.go, while its fshttp.NewClient client follows...

CVE-2026-4129 Improper Access Controls in NI SystemLink

There is an improper access control vulnerability in NI SystemLink that may allow an authenticated user with limited privileges to access host operating system files and directories that should be restricted. This vulnerability affects NI SystemLink and NI SystemLink Server 2026 Q3 and prior...

EUVD-2026-75564

There is an improper access control vulnerability in NI SystemLink that may allow an authenticated user with limited privileges to access host operating system files and directories that should be restricted. This vulnerability affects NI SystemLink and NI SystemLink Server 2026 Q3 and prior...

CVE-2026-4129

NI SystemLink and NI SystemLink Server (versions 2026 Q3 and prior) contain an improper access control vulnerability that allows an authenticated user with limited privileges to access host operating system files and directories that should be restricted. The CVSS 3.1 score is 8.1 (HIGH) with hig...

CVE-2026-85597

A flaw was found in Traefik. This vulnerability allows unauthenticated attackers to bypass client-certificate authentication. By creating conflicting Transport Layer Security TLS options on multi-host routers, attackers can exploit shared TLS resolution across multiple hostnames in a single route...

EUVD-2026-75442

OpenPanel is an analytics platform. In all versions no patched release available at time of publication, the data importer fetches a caller-supplied URL with plain fetch instead of the project's existing SSRF guard apps/api/src/utils/safe-fetch.ts. In packages/importer/src/providers/umami.ts,...

CVE-2026-88892 OpenPanel through 2.3.0 SSRF via Unguarded Importer File URL Fetch

In OpenPanel through 2.3.0, the data importer fetches a caller-supplied URL with plain fetch instead of the project's existing SSRF guard apps/api/src/utils/safe-fetch.ts. In packages/importer/src/providers/umami.ts, parseRemoteFile calls fetch on config.fileUrl, which is validated only by...

CVE-2026-88892

OpenPanel , an analytics platform, has a server-side request forgery (SSRF) vulnerability in its data importer. The parseRemoteFile function in packages/importer/src/providers/umami.ts calls plain fetch() on a caller-supplied fileUrl validated only by z.string().url(), bypassing the project's exi...

CVE-2026-88881 Renovate before 44.11.3 Credential Exfiltration via Link Header

Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP Link header when interacting with GitHub.com, GitHub Enterprise Cloud, or GitHub Enterprise Server, and sends the credentials configured for that host to the URL given as the 'next' page. Becaus...

EUVD-2026-75427

Traefik is a HTTP reverse proxy and load balancer. In versions = v3.7.0 and = v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creat...

CVE-2026-88877

Traefik is a HTTP reverse proxy and load balancer. In versions = v3.7.0 and = v3.7.11, the Kubernetes ingress-nginx provider mishandles Ingresses that carry both an authentication annotation and the nginx.ingress.kubernetes.io/from-to-www-redirect annotation. For such Ingresses the provider creat...

net/url: Incorrect parsing of IPv6 host literals in net/url

The Go standard library function net/url.Parse insufficiently validated the host/authority component and accepted some invalid URLs by effectively treating garbage before an IP-literal as ignorable. The function should have rejected this as invalid...

CVE-2026-84828

A flaw was found in PCS Pacemaker Configuration System. A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read wit...

CVE-2026-84828

A flaw was found in PCS Pacemaker Configuration System. A local attacker with membership in the 'haclient' group can exploit the 'pcs host auth --token' command to read the contents of arbitrary files on the filesystem, provided the files are shorter than 256 bytes. The file contents are read wit...

Malicious code in express-yandex-host-fallback (npm)

The package express-yandex-host-fallback was found to contain malicious code. --- Credit: OpenSSF source...

PYSEC-2026-3834 ESPHome Device Builder Dashboard: Unauthenticated dashboard access via the HA add-on ingress site bound to all interfaces

Summary On the Home Assistant add-on, the dashboard serves a trusted ingress site that skips authentication because the supervisor authenticates the request upstream. That site was binding 0.0.0.0. The add-on runs in host network mode for mDNS, so binding all interfaces also bound the host's LAN...

unstructured: Server-Side Request Forgery in the URL-based partitioning

SummaryServer-Side Request Forgery in unstructured. The url= argument of partition, partitionhtml, and partitionmd is fetched via requests.get with no host validation. The response body is returned as Element text, so this is a full-read SSRF — attackers reach loopback admin APIs, internal HTTP...

PYSEC-2026-3855 kas Persistently Disables SSH Host Key Checking

Summary kas persistently disables SSH host key checking for the invoking user when internal SSH key setup is triggered via SSHPRIVATEKEY or SSHPRIVATEKEYFILE and no user-specific SSH configuration file exists so far. When this path is used, kas creates /.ssh/config with a global Host rule...

kas Persistently Disables SSH Host Key Checking

Summarykas persistently disables SSH host key checking for the invoking user when internal SSH key setup is triggered via SSHPRIVATEKEY or SSHPRIVATEKEYFILE and no user-specific SSH configuration file exists so far.When this path is used, kas creates /.ssh/config with a global Host rule containin...

PYSEC-2026-3927 Apache Thrift Python bindings have a Improper Validation of Certificate with Host Mismatch vulnerabilit

Improper Validation of Certificate with Host Mismatch vulnerability in Apache Thrift Python bindings. This issue affects Apache Thrift: before 0.24.0. Users are recommended to upgrade to version 0.24.0, which fixes the issue. This replaces CVE-2026-41603...