CVE-2026-92284: Allocation of Resources Without Limits or Throttling

Caddy is an extensible server platform that uses TLS by default. In version 2.11.3 and earlier, in modules/caddyhttp/replacer.go, resolving http.request.body reads the complete request body with an unbounded io.Copy before request-body middleware limits apply, allowing memory exhaustion and proce...

TencentOS Server 4: environment-modules (TSSA-2026:1035)

The version of Tencent Linux installed on the remote TencentOS Server 4 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the TSSA-2026:1035 advisory. Package updates are available for TencentOS Server 4 that fix the following vulnerabilities:...

PT-2026-96717

Name of the Vulnerable Software and Affected Versions MISP versions prior to 2.5.47 Description The WorkflowsController exposes the moduleStatelessExecution action within the Security component's unlockedActions list. In the CakePHP framework, including an action in unlockedActions disables field...

CVE-2026-61852

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js interpolates the AI tool's rowlimit parameter into a SQL LIMIT...

CVE-2026-61743 Chartbrew: DNS Rebinding SSRF Bypass in Outbound Request Validation

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's server/modules/safeRequest.js calls validateOutboundUrl to resolve and validate a target hostname, but request-promise performs a separate DNS...

CVE-2026-61743: Reliance on Reverse DNS Resolution for a Security-Critical Action

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's server/modules/safeRequest.js calls validateOutboundUrl to resolve and validate a target hostname, but request-promise performs a separate DNS...

CVE-2026-36467: Unrestricted Upload of File with Dangerous Type

Unrestricted Upload of File with Dangerous Type in core/modules/media.php in CuteNews v.2.1.2 allows remote authenticated users with access to the Media Manager panel to execute arbitrary code in the context of the web application, leading to remote server access by triggering a reverse shell...

PT-2026-96126

Name of the Vulnerable Software and Affected Versions CuteNews version 2.1.2 Description Server-Side Request Forgery SSRF exists in the Media Manager's "Upload by URL" functionality. The issue is located in the upload from inet function within the core/modules/media.php file. Recommendations As a...

PT-2026-96299

Name of the Vulnerable Software and Affected Versions Chartbrew versions prior to 5.2.2 Description An authenticated user capable of creating or testing API connections can exploit a DNS rebinding condition. This occurs because the validateOutboundUrl function in server/modules/safeRequest.js...

CVE-2026-36469: Server-Side Request Forgery (SSRF)

CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery SSRF in core/modules/media.php -- uploadfrominet Media Manager's "Upload by URL" functionality...

CVE-2026-61851: Incomplete List of Disallowed Inputs

Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. Prior to 5.2.2, Chartbrew's runQuery implementation in server/modules/ai/orchestrator/tools/runQuery.js attempts to enforce read-only database access with a blocklist...

CVE-2026-36469

CuteNews v.2.1.2 is vulnerable to Server-Side Request Forgery SSRF in core/modules/media.php -- uploadfrominet Media Manager's "Upload by URL" functionality...

PT-2026-96124

Name of the Vulnerable Software and Affected Versions CuteNews version 2.1.2 Description An unrestricted file upload issue exists in the core/modules/media.php file. Remote authenticated users with access to the Media Manager panel can upload files of dangerous types to execute arbitrary code...

PT-2026-97440

Name of the Vulnerable Software and Affected Versions Caddy versions prior to 2.11.4 Description In the modules/caddyhttp/replacer.go file, resolving the http.request.body variable reads the entire request body using an unbounded io.Copy operation. This occurs before the request-body middleware...

PT-2026-97441

Name of the Vulnerable Software and Affected Versions Caddy versions prior to 2.11.4 Description The fileHidden function in modules/caddyhttp/fileserver/staticfiles.go employs case-sensitive filepath.Match checks. This behavior allows case variants to bypass hide rules on case-insensitive...

[SECURITY] Fedora 43 Update: environment-modules-5.6.2-1.fc43

The Environment Modules package provides for the dynamic modification of a user's environment via modulefiles. Each modulefile contains the information needed to configure the shell for an application. Once the Modules package is initialized, the environment can be modified on a per-module basis...

[SECURITY] Fedora 44 Update: environment-modules-5.6.2-1.fc44

The Environment Modules package provides for the dynamic modification of a user's environment via modulefiles. Each modulefile contains the information needed to configure the shell for an application. Once the Modules package is initialized, the environment can be modified on a per-module basis...

[SECURITY] Fedora 45 Update: environment-modules-5.6.2-1.fc45

The Environment Modules package provides for the dynamic modification of a user's environment via modulefiles. Each modulefile contains the information needed to configure the shell for an application. Once the Modules package is initialized, the environment can be modified on a per-module basis...

Fedora 43 : environment-modules (2026-6a8bb95fd4)

The remote Fedora 43 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2026-6a8bb95fd4 advisory. Update to 5.6.2 fix CVE-2026-85013 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

CVE-2026-83446

A vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Common Components ) affects supported versions 12.2.3 through 12.2.15 . An easily exploitable flaw allows a low-privileged attacker with network access via HTTP to compromise the module, resulti...