PT-2026-82299

Name of the Vulnerable Software and Affected Versions Weblate versions prior to 2026.7 Description A project administrator can read files outside their repository using the App store metadata download feature. This occurs because the system resolves attacker-influenced paths without adequately...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098833)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098833 advisory. In the Linux kernel, the following vulnerability has been resolved: net/sched: actife: Fix metalist update behavior Whenever an ife action replace changes the...

PT-2026-82339

Name of the Vulnerable Software and Affected Versions jetlinks community version 2.11 Description The device metadata import interface '/device/instance/productId/property-metadata/import' is susceptible to Server-side request forgery SSRF, a flaw that allows an attacker to induce the server-side...

CVE-2026-80350: Server-Side Request Forgery (SSRF)

OneUptime's webhook target check rejects private and loopback addresses given in IPv4 form and a small set of IPv6 forms, but has no case for the IPv4-mapped IPv6 range. The webhook delivery path calls SSRFProtection.validateWebhookTargetIsSafe, and the host-literal screening inside...

CVE-2026-52776: Incomplete List of Disallowed Inputs

Compliance-trestle Trestle is a tooling platform for managing compliance as code. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the URLSecurityValidator that guards trestle's remote-fetch paths against server-side request forgery can be bypassed to reach loopback, link-local,...

CVE-2026-75340

The device metadata import interface /device/instance/productId/property-metadata/import of jetlinks community 2.11 is vulnerable to Server-side request forgery SSRF...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-098735)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-098735 advisory. In the Linux kernel, the following vulnerability has been resolved: btrfs: ensure no dirty metadata is written back for an fs with errors BUG During development of a...

CVE-2026-75340

The device metadata import interface /device/instance/productId/property-metadata/import of jetlinks community 2.11 is vulnerable to Server-side request forgery SSRF...

CVE-2026-75340: Server-Side Request Forgery (SSRF)

The device metadata import interface /device/instance/productId/property-metadata/import of jetlinks community 2.11 is vulnerable to Server-side request forgery SSRF...

CVE-2026-80347: Server-Side Request Forgery (SSRF)

mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSafeUrl reads the hostname from the parsed URL, which for a literal such as http://::1/ yields the bracketed string, and then tests it with net.isIP. That call returns zero for a...

PT-2026-82065

mcp-fetch checks a fetch target against its SSRF guard without removing the brackets that surround an IPv6 literal. isSafeUrl reads the hostname from the parsed URL, which for a literal such as http://::1/ yields the bracketed string, and then tests it with net.isIP. That call returns zero for a...

CVE-2026-75340

The device metadata import interface /device/instance/productId/property-metadata/import of jetlinks community 2.11 is vulnerable to Server-side request forgery SSRF...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104554)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104554 advisory. In the Linux kernel, the following vulnerability has been resolved: dm thin metadata: fix metadata snapshot consistency on commit failure reservemetadatasnap and...

CVE-2026-75340

The jetlinks community version 2.11 is vulnerable to Server-side request forgery (SSRF) via the device metadata import interface /device/instance/{productId}/property-metadata/import. An attacker can exploit the {productId} parameter to induce the server-side application to make requests to unint...

CVE-2026-77507: Exposure of Sensitive Information to an Unauthorized Actor

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do not apply the permission checks used elsewhere, allowing unauthorized users to read change-history metadata from private projects and...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-104586)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-104586 advisory. In the Linux kernel, the following vulnerability has been resolved: ocfs2: reject dinodes with non-canonical imode type Patch series ocfs2: harden inode validators...

CVE-2026-13404: Authorization Bypass Through User-Controlled Key

The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or ownership check relying only on a publicly-scrapeable nonce before writing like-count and visitor-tracking post meta keyed on an arbitrary post ID, allowing unauthenticated users to modify that...

Linux Distros Unpatched Vulnerability : CVE-2026-79783

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - rclone before 1.74.4 fails to mask special permission bits when applying source-supplied mode metadata in the local backend, allowing attackers to set...

CVE-2026-52776 Trestle URLSecurityValidator SSRF allowlist bypass via IPv4-mapped IPv6 and 0.0.0.0

Compliance-trestle Trestle is a tooling platform for managing compliance as code. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the URLSecurityValidator that guards trestle's remote-fetch paths against server-side request forgery can be bypassed to reach loopback, link-local,...

CVE-2026-52776

Compliance-trestle Trestle is a tooling platform for managing compliance as code. In versions before 3.12.4 and versions 4.0.0 through 4.0.3, the URLSecurityValidator that guards trestle's remote-fetch paths against server-side request forgery can be bypassed to reach loopback, link-local,...