CVE-2026-59092: Active Debug Code

JuiceFS through 1.3.1, fixed in commit a46979c, contains an authentication bypass vulnerability that allows unauthenticated remote attackers to access sensitive debug and metrics endpoints by exploiting improper handler registration on the shared http.DefaultServeMux. Attackers can request the...

PT-2026-76821

Name of the Vulnerable Software and Affected Versions MLflow versions prior to 3.15.0 Description An unauthenticated Server-Side Request Forgery SSRF exists in the MLflow Tracking Server. The POST /api/2.0/mlflow/webhooks/id/test endpoint allows an attacker to make the server issue HTTP requests ...

Linux Distros Unpatched Vulnerability : CVE-2026-13316

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw has been found in foreman when HTTP parameters are modified in httpproxiescontroller and httpproxy files. Attackers can perform an SSRF attack and steal...

PT-2026-54938

The My Calendar – Accessible Event Manager plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.14 via the 'vcal' parameter due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to...

CVE-2026-58580: Authorization Bypass Through User-Controlled Key

LobeChat through 2.2.9 server-database deployments are vulnerable to broken object-level authorization in MessageModel. The updateMessagePlugin, updatePluginState, updatePluginError, updateTTS and updateTranslate methods filter target rows by message id alone, omitting the userId scope that sibli...

wagtail-metadata-mixin (0.0.7), wagtailperson (0.9.8) potentially affected by CVE-2026-54260 via wagtail (2.8.0)

wagtail PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-metadata-mixin 0.0.7 - wagtailperson 0.9.8 Source cves: CVE-2026-54260 Source advisory: OSV:PYSEC-2026-613...

wagtail-metadata-mixin (0.0.7), wagtailperson (0.9.8) potentially affected by CVE-2026-54262 via wagtail (2.8.0)

wagtail PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-metadata-mixin 0.0.7 - wagtailperson 0.9.8 Source cves: CVE-2026-54262 Source advisory: OSV:PYSEC-2026-615...

wagtail-metadata-mixin (0.0.7), wagtailperson (0.9.8) potentially affected by CVE-2026-54259 via wagtail (2.8.0)

wagtail PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-metadata-mixin 0.0.7 - wagtailperson 0.9.8 Source cves: CVE-2026-54259 Source advisory: OSV:PYSEC-2026-612...

wagtail-metadata-mixin (0.0.7), wagtailperson (0.9.8) potentially affected by CVE-2026-54261 via wagtail (2.8.0)

wagtail PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-metadata-mixin 0.0.7 - wagtailperson 0.9.8 Source cves: CVE-2026-54261 Source advisory: OSV:PYSEC-2026-614...

nodejs: Node.js: Unauthorized file metadata modification

A flaw was found in Node.js. The Permission API allows a local user to modify file metadata on paths that have been explicitly set as read-only. This can lead to unauthorized changes in file properties, impacting the integrity of the file system...

EUVD-2026-41109

containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface CDI annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a...

CVE-2026-53492

Summary: CVE-2026-53492 affects containerd’s CRI checkpoint restoration, where CDI annotations in untrusted checkpoint metadata are trusted, allowing injection of CDI edits (device nodes/host mounts) into restored containers if CDI is enabled and a matching host CDI spec exists. The issue affects...

CVE-2026-53492 containerd CRI checkpoint restore CDI annotation smuggling

containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface CDI annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a...

CVE-2026-53492 containerd CRI checkpoint restore CDI annotation smuggling

containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface CDI annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a...

CVE-2026-53492

containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface CDI annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a...

CVE-2026-53492

containerd is an open-source container runtime. In Versions prior to 2.3.2, 2.2.5 and 2.1.9, the CRI implementation improperly trusts Container Device Interface CDI annotations found within untrusted checkpoint image metadata during container restoration. When restoring a container from a...

Missing Authorization

Overview org.geonetwork-opensource:gn-services is a GeoNetwork Services. Affected versions of this package are vulnerable to Missing Authorization due to the omission of the query field in the request body, which causes the access-control filter-injection process to be skipped. An attacker can...

GeoNetwork has ACL bypass on Elasticsearch search when request body omits query field

Summary GeoNetwork's Elasticsearch-backed search API is responsible for injecting access-control and visibility filters into every request before it reaches the underlying Elasticsearch index. Under certain request conditions, that filtering step does not run, allowing an unauthenticated user to...

foreman: Foreman: Information disclosure via improper validation of nested request parameters

A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occurs because the taxonomyscope controller method does not properly validate organization and location IDs from nested request parameters,...

foreman: Foreman: Information disclosure via improper validation of nested request parameters

A flaw was found in Foreman. An authenticated user with host-edit permissions could exploit a cross-tenant information disclosure vulnerability. This flaw occurs because the taxonomyscope controller method does not properly validate organization and location IDs from nested request parameters,...