PT-2026-83373

Name of the Vulnerable Software and Affected Versions MariaDB Connector/J versions prior to 2.7.14 MariaDB Connector/J versions prior to 3.3.5 MariaDB Connector/J versions prior to 3.4.3 MariaDB Connector/J versions prior to 3.5.9 Description When using PAM dialog authentication, the connector ca...

PT-2026-83348

Name of the Vulnerable Software and Affected Versions MariaDB Connector/Node.js versions prior to 3.2.4 MariaDB Connector/Node.js versions prior to 3.3.3 MariaDB Connector/Node.js versions prior to 3.4.6 MariaDB Connector/Node.js versions prior to 3.5.3 Description MariaDB Connector/Node.js can...

CVE-2026-82237: Incomplete Cleanup

filebrowser through 2.63.23 does not remove share records when a shared file is renamed only deletion triggers share cleanup. The share record is keyed by path, so it survives the rename and remains dormant returning 404 while the path is empty. When any new, unrelated file later appears at the...

The vulnerability of the Git-based software platform for collaborative code development on GitLab, related to the inclusion of functions from an unreliable and uncontrolled area, allows a perpetrator to execute arbitrary code.

The vulnerability of the Git-based software platform for collaborative code development on GitLab is related to the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

The vulnerability of the programmatically defined Cisco Catalyst SD-WAN (formerly Cisco SD-WAN) lies in the fact that information is stored in an open manner, allowing attackers to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the programmatically defined Cisco Catalyst SD-WAN formerly Cisco SD-WAN is related to the storage of information in an open manner. Exploiting this vulnerability can allow a malicious actor to compromise the confidentiality, integrity, and accessibility of the protected...

Unity Linux 20.1050e / 20.1060e / 20.1070-8ae / 20.1070e Security Update: rubygem-bundler (UTSA-2024-005590)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2024-005590 advisory. Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directo...

CVE-2026-77438

Trilium is an open-source hierarchical note-taking application. In versions up to and including 0.103.0, the public share-search endpoint does not enforce the per-note shareCredentials and shareHiddenFromTree controls, allowing an unauthenticated visitor to read the titles, tree paths, and conten...

CVE-2026-59292

PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to $java.io.tmpdir/spring-integration/metadata-store.properties with world-readable permissions. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring...

EUVD-2026-67203

The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizin...

CVE-2026-59322 EmbeddedHeadersJsonMessageMapper default gives wire peer full control of MessageHeaders

The EmbeddedHeadersJsonMessageMapper defaults to an overly permissive header parsing posture in its constructor. When decodeNativeFormat processes raw byte payloads, it deserializes embedded JSON headers into a plain Map and constructs a GenericMessage with MutableMessageHeaders without sanitizin...

CVE-2026-59292 World-readable metadata file in PropertiesPersistingMetadataStore (insecure temp-file permissions)

PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to $java.io.tmpdir/spring-integration/metadata-store.properties with world-readable permissions. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring...

PYSEC-2026-3802

opensslencrypt before 1.4.9 executes untrusted third-party plugins with insufficient controls: the plugin signature policy defaulted to WARN, so an unsigned/unverifiable non-built-in plugin was compiled and executed in the host process at import time, before the runtime sandbox is installed. The...

PYSEC-2026-3792

opensslencrypt pip package openssl-encrypt versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable 0644 SharedPreferences file via the desktop GUI's Settings screen 'combined certificate and private key' PEM field. A local attacker with file system access...

CVE-2026-81682

opensslencrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems...

CVE-2026-81682 openssl_encrypt before 1.4.9 Insecure File Permissions

opensslencrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems...

CVE-2026-81683

CVE-2026-81683 affects the openssl_encrypt Python package (pip name openssl-encrypt) versions 1.4.8 and earlier . The vulnerability is in the desktop GUI's Settings screen, where a "combined certificate and private key" PEM field stores an mTLS client private key in cleartext within a world-reada...

CVE-2026-81682

opensslencrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems...

CVE-2026-81682

openssl_encrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI. The GUI writes decrypted plaintext with world-readable default permissions , allowing unprivileged local users on multi-user systems to read decrypted output files. The CVSS 3.1 score is 6...

CVE-2026-81682 openssl_encrypt before 1.4.9 Insecure File Permissions

opensslencrypt versions before 1.4.9 contain an insecure file permissions vulnerability in the desktop GUI that writes decrypted plaintext with world-readable default permissions. Attackers can read decrypted output files created by the GUI as unprivileged local users on multi-user systems...

EUVD-2026-67039

opensslencrypt pip package openssl-encrypt versions 1.4.8 and earlier store an mTLS client private key in cleartext within a world-readable 0644 SharedPreferences file via the desktop GUI's Settings screen 'combined certificate and private key' PEM field. A local attacker with file system access...