PT-2026-77186

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend digital asset operations allow a low-privileged Vendor to access digital assets linked to another Vendor's products. The admin/controller/product/digital-asset.p...

PT-2026-80463

uniget CLI: Metadata signature verification only runs when UNIGET IGNORE METADATA SIGNATURE is set in gitlab.com/uniget-org/cli...

PT-2026-80423

Unsafe file permission restoration from metadata in github.com/rclone/rclone...

CVE-2026-50167: Authorization Bypass Through User-Controlled Key

Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook and identity resources did not enforce ownership checks for authenticated API requests. An attacker with a valid API key could use anothe...

PT-2026-77281

Name of the Vulnerable Software and Affected Versions Lemur versions prior to 1.9.3 Description An issue exists where the validate acme url function fails to enforce the ACME DIRECTORY HOST ALLOWLIST when updating authority options via the 'PUT /api/1/authorities/' endpoint. A user with an...

PT-2026-77306

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the DEVICE BROWSE, DEVICE NODE ATTRIBUTE, HOST INTERFACES, and DEVICE TAGS REQUEST handlers in server/runtime/index.js return device-discovery, node-attribute, host-network-interface, and device-tag...

CVE-2026-75898: Server-Side Request Forgery (SSRF)

RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component agent/component/invoke.py. The component builds an outbound request URL from canvas configuration and runtime template variables and passes it to requests.get, requests.post, or...

PT-2026-80359

OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search in github.com/OpenListTeam/OpenList...

PT-2026-77139

Name of the Vulnerable Software and Affected Versions RAGFlow versions prior to 0.26.3 Description A server-side request forgery SSRF issue exists in the agent workflow "Invoke" component located in agent/component/invoke.py. The component constructs outbound request URLs using canvas configurati...

CVE-2026-70666: Server-Side Request Forgery (SSRF)

Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acmeurl through PUT /api/1/authorities/ without revalidation and direct setupacmeclientnoretry to an attacker-controlled ACME server. ACME directory and order responses contain newNonce, newOrder,...

CVE-2026-74904: Missing Authorization

SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go including getRefText, checkBlockExist, and getBlockBreadcrumb. These handlers are gated only by basic authentication model.CheckAuth and lack publish-access filtering, allowing...

PT-2026-80295

Summary Multiple GeoLens read/link endpoints authorized only the resource named in the request URL a map, a VRT, a source dataset, an AI request and failed to re-authorize a second, caller-influenced dataset that the request reached through a relationship, layer reference, mosaic source, or reque...

PT-2026-76944

ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validat...

VulnCheck KEV: CVE-2026-64849

MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive responsestatus and responsebody...

CVE-2026-71303: Server-Side Request Forgery (SSRF)

Lemur manages TLS certificate creation. Prior to 1.9.3, validateacmeurl enforced ACMEDIRECTORYHOSTALLOWLIST when an authority was created, but PUT /api/1/authorities/ passed options to lemur/authorities/service.py without applying the same check. A user holding an authority role could replace the...

Linux Distros Unpatched Vulnerability : CVE-2026-72108

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - dm thin metadata: fix metadata snapshot consistency on commit failure reservemetadatasnap and releasemetadatasnap modify the superblock's heldroot directly in t...

PT-2026-79918

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer role to modify certain package registry metadata without the required...

Linux Distros Unpatched Vulnerability : CVE-2026-72426

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: bpf: Preserve pointer spill metadata during half-slot cleanup cleanfuncstate cleans dead sta...

Linux Distros Unpatched Vulnerability : CVE-2026-72186

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In the Linux kernel, the following vulnerability has been resolved: ntfs: make system files immutable to prevent corruption When a system file such as $Bitmap i...

tailscale -- Insufficient validation of 4via6 subnet router destinations

Tailscale team reports: Insufficient validation of 4via6 subnet router destinations permitted access to host-scoped addresses, including cloud metadata and loopback services. TS-2026-11...