CVE-2026-87890

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply bytes values to cause the Django process to make network requests via a crafted VRT document referencing an...

PT-2026-106734

Name of the Vulnerable Software and Affected Versions Django versions prior to 6.1.2 Django versions prior to 6.0.9 Django versions prior to 5.2.18 Description An incomplete fix in spatial lookups allows an attacker to trigger network requests by providing bytes values. This occurs through a...

Linux Distros Unpatched Vulnerability : CVE-2026-87890

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete fix for CVE-2026-15307 in Django spatial lookups allo...

CVE-2026-87890: Server-Side Request Forgery (SSRF)

An issue was discovered in Django 6.1 before 6.1.2, 6.0 before 6.0.9, and 5.2 before 5.2.18. An incomplete fix for CVE-2026-15307 in Django spatial lookups allows an attacker who can supply bytes values to cause the Django process to make network requests via a crafted VRT document referencing an...

Time-of-check Time-of-use (TOCTOU) Race Condition

Overview docling-slim is a Modular version of the Docling package: SDK and CLI for parsing PDF, DOCX, HTML, and more, to a unified document representation for powering downstream workflows such as gen AI applications. Affected versions of this package are vulnerable to Time-of-check Time-of-use...

CVE-2026-63267

A flaw was found in LibreOffice. When loading a spreadsheet, external comma-separated values CSV data links were automatically fetched without applying standard link update controls. A remote attacker could exploit this vulnerability by enticing a user to open a specially crafted document, causin...

CVE-2026-105647: Time-of-check Time-of-use (TOCTOU) Race Condition

Ghost is a Node.js content management system. From 6.54.1 until 6.65.0, a validation issue allowed some functionality, such as Webmentions, to be abused by an unauthenticated user to make limited HTTP requests to hosts in the Ghost server's internal network. A successful attack would not result i...

[SECURITY] [DLA 4815-1] freecad security update

Debian LTS Advisory DLA-4815-1 [email protected] https://www.debian.org/lts/security/ Tobias Frost October 03, 2026 https://wiki.debian.org/LTS Package : freecad Version : 0.20.2+dfsg1-4+deb12u1 CVE ID : CVE-2026-34789 CVE-2026-73234 CVE-2026-73235 Debian Bug : 1144349 Three...

Debian dla-4815 : freecad - security update

The remote Debian 12 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4815 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4815-1 [email protected]...

CVE-2026-88789

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...

CVE-2026-88789

The camel-quarkus-support-xalan extension in Apache Camel Quarkus (versions 3.2.0 to 3.33.3 and 3.34.0 to 3.40.0) is vulnerable to CWE-611 due to a forced Xalan TransformerFactory that fails to honor JAXP external access restrictions. An attacker providing an XML document transformed via the xslt...

CVE-2026-88789: Improper Restriction of XML External Entity Reference

Improper Restriction of XML External Entity Reference in the XSLT support extension camel-quarkus-support-xalan in Apache Camel Quarkus from 3.2.0 before 3.33.3 and from 3.34.0 before 3.40.0 on all platforms allows an attacker who supplies the XML document being transformed to read local files or...

PT-2026-103830

Name of the Vulnerable Software and Affected Versions Apache Camel Quarkus versions 3.2.0 through 3.33.2 Apache Camel Quarkus versions 3.34.0 through 3.39.9 Description Improper restriction of XML External Entity XXE references in the XSLT support extension camel-quarkus-support-xalan allows an...

CVE-2026-102105

Kiteworks Email Protection Gateway before version 9.5.0 is vulnerable to Server-Side Request Forgery SSRF. A server-side request forgery SSRF weakness in Kiteworks Email Protection Gateway could allow a remote, unauthenticated attacker to induce the gateway to issue crafted requests to internal o...

CVE-2026-102091

Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only servic...

EUVD-2026-90372

Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only servic...

CVE-2026-102091 Kiteworks Secure Data Forms server-side request forgery

Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to Server-Side Request Forgery that could allow an unauthenticated, remote attacker to make the server issue arbitrary outbound network requests and read back the responses. This could potentially be used to reach internal-only servic...

CVE-2026-102091

Kiteworks Secure Data Forms before version 9.5.0 is vulnerable to a Server-Side Request Forgery (SSRF) . This flaw allows an unauthenticated, remote attacker to compel the server to issue arbitrary outbound network requests and read back the responses. Such exploitation could enable the attacker ...

USN-8848-1 python-django vulnerabilities

Bence Nagy discovered that GeoDjango in Django incorrectly handled spatial lookups when processing untrusted input. A remote attacker could possibly use this issue to make outbound network requests, write arbitrary files, or execute arbitrary code. This issue was only addressed in Ubuntu 22.04 LT...

PT-2026-103541

Name of the Vulnerable Software and Affected Versions Kiteworks Email Protection Gateway versions prior to 9.5.0 Description A Server-Side Request Forgery SSRF weakness allows a remote, unauthenticated attacker to force the gateway to send crafted requests to internal or unintended network...