CVE-2026-74234

Legora before 2026-08-14 contains a cross-site scripting (XSS) vulnerability. The root cause is that a Mermaid block prefixed with a gray-matter JavaScript front-matter directive causes the front-matter parser to invoke eval() before any SVG sanitization occurs, enabling arbitrary JavaScript exec...

CVE-2026-74234

...

CVE-2026-71290

A flaw was found in the asynchronous version of Apache HttpComponents Client. This improper Transport Layer Security TLS hostname verification vulnerability allows a remote attacker to intercept and modify network traffic. By presenting a valid certificate for a different domain, an attacker can...

EUVD-2026-60359

Certain HP Smart Tank All-in-One printers may be potentially vulnerable to a denial of service condition that allows an unauthenticated attacker to cause the device to become unavailable by sending multiple concurrent HTTP requests...

RLSA-2026:55439 Important: curl security update

The curl packages provide the libcurl library and the curl utility for downloading files from servers using various protocols, including HTTP, FTP, and LDAP. Security Fixes: curl: curl: Authentication bypass due to incorrect connection reuse with Negotiate authentication CVE-2026-1965 curl: curl:...

CVE-2026-68520 Glances: as_dict_secure() Value-Level Bypass Leaks Credentials in URL Values via /api/4/config

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, asdictsecure in glances/config.py checks only option names and exposes publicusername and credentials embedded in publicapi values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This iss...

GHSA-8R8V-XF7Q-RCPR New API: Integer overflow in quota billing yields negative charges (self-crediting)

Summary Multiple billing paths multiplied user-controlled quantity parameters into the quota calculation without an upper bound or overflow-safe integer conversion. A crafted extreme value e.g. image n = 18446744073686646784, a wrapped-negative accepted by a uint field makes conversions like...

CVE-2026-71479 New API: Integer overflow in quota billing yields negative charges (self-crediting)

New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to 1.0.0-rc.18, user-controlled image n, video seconds and duration, maxtokens, maxcompletiontokens, maxOutputTokens, audio duration, and billing-expression quantities can overflow conversio...

CVE-2026-72296

A flaw was found in the Linux kernel's In-band Flow Engine IFE component. A remote attacker could send a specially crafted IFE frame with a malformed inner Ethernet header. This improper handling of the packet structure could lead to a system crash, resulting in a Denial of Service DoS...

PYSEC-2026-3757

opensslencrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server restart. Attackers can distribute authentication attempts across multiple server instances or retry immediately after a restart to bypass rate...

PYSEC-2026-3757

opensslencrypt versions before 1.4.0 use an in-memory rate limiter for TOTP brute-force protection that is not shared across workers and is lost on server restart. Attackers can distribute authentication attempts across multiple server instances or retry immediately after a restart to bypass rate...

CVE-2026-74870

opensslencrypt pip versions = 1.4.7 contain an information exposure vulnerability where the 'hsm fido2-test' and 'hsm onlykey-test' diagnostic commands unconditionally print the full derived hardware pepper as hex to stdout/stderr cryptcli.py, handlehsmcommand. The printed value can persist in...

CVE-2026-74870

openssl_encrypt (pip) versions

CVE-2026-74799

SiYuan before 3.7.4 registers Go net/http/pprof debug endpoints including heap and goroutine dumps without authentication when --mode flag is not set to exactly prod. Attackers can access /debug/pprof/heap and related endpoints to extract in-memory secrets including AccessAuthCode and AI provider...

curl: curl: Man-in-the-middle attack via SSH host key bypass

A flaw was found in curl. When a libcurl-based application uses SCP:// or SFTP:// for transfers and employs the CURLOPTSSHKEYFUNCTION callback, it may silently accept an untrusted server. This occurs if the server's host key type differs from the one stored in the knownhosts file. The callback...

BIT-RCLONE-2026-71311 rclone: FTP Command Arguments Permit CRLF Injection When Custom Encoding Preserves Newlines

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.0, a valid but nondefault FTP filename encoding in backend/ftp/ftp.go can restore raw CR/LF immediately before an attacker-controlled path is interpolated into the...

curl: curl: Man-in-the-middle attack via SSH host key bypass

A flaw was found in curl. When a libcurl-based application uses SCP:// or SFTP:// for transfers and employs the CURLOPTSSHKEYFUNCTION callback, it may silently accept an untrusted server. This occurs if the server's host key type differs from the one stored in the knownhosts file. The callback...

curl: curl: SSH host verification bypass when using schemeless URLs with SFTP/SCP

A flaw was found in curl. When a user invokes curl with a schemeless URL and specifies SFTP SSH File Transfer Protocol or SCP Secure Copy Protocol as the default protocol, the tool layer fails to initialize critical SSH security options. This bypasses host verification, allowing curl to connect t...

PT-2026-76760

Name of the Vulnerable Software and Affected Versions Stirling-PDF versions prior to 2.9.0 Description The application injects the STIRLING-PDF-BACKEND-API-USER API key into pipeline subrequests via the '/api/v1/pipeline/handleData' endpoint. This allows an authenticated user with ROLE USER...

PT-2026-76724

Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.6 Description An issue exists in the as dict secure function within glances/config.py where the sanitization process only validates option names against a regex pattern and fails to inspect the actual values. This...