fast-uri: fast-uri: Host confusion via unbalanced URI brackets can bypass security policies

A flaw was found in fast-uri. The library incorrectly processes Uniform Resource Identifier URI hosts containing unbalanced brackets, leading to a discrepancy in how the host is parsed by fast-uri compared to other HTTP clients. This host confusion can allow an attacker to bypass security policie...

foreman: Excessive Permissions for Viewer Role on Preview

A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root...

Security Bulletin: IBM WebSphere Application Server Liberty prior to 26.0.0.9 is affected by multiple vulnerabilities

Summary IBM WebSphere Application Server Liberty prior to 26.0.0.9 is affected by multiple vulnerabilities. Vulnerability Details CVEID:CVE-2026-10841 DESCRIPTION: IBM WebSphere Application Server 8.5, 9.0, and Liberty are vulnerable to HTTP request smuggling. CWE:CWE-444: Inconsistent...

CVE-2026-79899 Fortra BoKS Manager bccgethostcert insecure temporary file vulnerability

Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKStmp may be able to obtain CA secret or host private-key...

CVE-2026-79899 Fortra BoKS Manager bccgethostcert insecure temporary file vulnerability

Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKStmp may be able to obtain CA secret or host private-key...

EUVD-2026-90871

Fortra BoKS Manager contains an insecure temporary file vulnerability in bccgethostcert. The utility creates predictable temporary files without first setting a restrictive umask. A local user on the BoKS Master who can read files under BOKStmp may be able to obtain CA secret or host private-key...

CVE-2018-18778

CVE-2018-18778 - ACME minihttpd Arbitrary File Read CVE-2018-18778 is a security vulnerability affecting ACME minihttpd a lightweight web server. The vulnerability allows remote attackers to read arbitrary files on the server. It was publicly disclosed in October 2018 and impacts versions of...

CVE-2026-103256

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account...

CVE-2026-103265 Fleet before 4.89.0 Information Disclosure via MDM Command Results

Fleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results endpoint. Team-scoped users can read MDM command results for hosts on other teams when a shared command UUID targets hosts across multiple teams, exposing host UUIDs, command...

CVE-2026-103265 Fleet before 4.89.0 Information Disclosure via MDM Command Results

Fleet versions before 4.89.0 fail to properly filter MDM command results by team authorization in the commands/results endpoint. Team-scoped users can read MDM command results for hosts on other teams when a shared command UUID targets hosts across multiple teams, exposing host UUIDs, command...

EUVD-2026-90650

n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain a credentials leak vulnerability in the Wekan and Baserow username-and-password credentials that sends unencrypted passwords to unvalidated hosts. Attackers with credential update permissions can modify the host field to receive account...

Improper Input Validation

Astro is vulnerable to Improper Input Validation. The vulnerability is due to improper handling of malformed port values in the HTTP Host header when constructing request URLs, which allows an attacker to trigger an uncaught TypeError that can cause the Node.js process to terminate and result in ...

CLEANSTART-2026-KC86970 Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component

Security vulnerability affects the cri-tools package. Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a hostname component...

K000163497: Podman vulnerability CVE-2024-11218

Security Advisory Description A vulnerability was found in podman build and buildah. This issue occurs in a container breakout by using --jobs=2 and a race condition when building a malicious Containerfile. SELinux might mitigate it, but even with SELinux on, it still allows the enumeration of...

Malicious code in @bluewin/utils (npm)

@bluewin/utils is a dependency-confusion package: it describes itself as a "PoC package for dependency confusion testing" and claims the @bluewin scope, so a build that resolves that scope from the public registry runs its code instead of the intended private package. Its postinstall script runs...

MAL-2026-17437 Malicious code in @bluewin/utils (npm)

@bluewin/utils is a dependency-confusion package: it describes itself as a "PoC package for dependency confusion testing" and claims the @bluewin scope, so a build that resolves that scope from the public registry runs its code instead of the intended private package. Its postinstall script runs...

CLEANSTART-2026-DC52993 Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery (SSRF) attack

Security vulnerability affects the apache-nifi package. Due to incorrect host parsing, applications that rely on UriComponentsBuilder to parse and validate an externally provided URL string may be exposed to a server-side request forgery SSRF attack...

CVE-2026-96659: Privilege Defined With Unsafe Actions

A flaw was found in Foreman. This vulnerability allows an authenticated user with low-level Viewer permissions to cause unauthorized information disclosure by submitting requests to template preview endpoints. By exploiting this issue, the user can access sensitive data, such as host root...

PT-2026-103819

Name of the Vulnerable Software and Affected Versions Ghost versions 1.18.0 through 6.26.0 Description A server-side request forgery SSRF issue exists in the webhooks feature. This allows users with staff privileges to craft requests that enable the Ghost server to probe and access internal netwo...

CVE-2026-18397: Improper Verification of Cryptographic Signature

This vulnerability enables unauthenticated remote code execution RCE on a victim's machine by exploiting a combination of cryptographic weaknesses and memory management issues in the SConnect native host component. The attack leverages an unrestricted messaging interface between an...