GHSA-CV2G-M8RR-888C vulnerabilities

Vulnerabilities for packages: apache-beam-python-3.13-sdk, apache-beam-python-3.12-sdk, apache-beam-python-3.11-sdk, py3-nltk, label-studio, nemo, open-webui, kubeflow-pipelines-visualization-server...

GHSA-CV2G-M8RR-888C vulnerabilities

Vulnerabilities for packages: py3-nltk, kubeflow-pipelines-visualization-server, open-webui...

CVE-2026-66393 vulnerabilities

Vulnerabilities for packages: py3-nltk, kubeflow-pipelines-visualization-server, open-webui...

CVE-2026-53728

Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly...

CVE-2026-49456

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...

Security Bulletin: MongoDB Enterprised Advanced affected by: Open Redirect (CVE-2026-40181)

Summary There are vulnerabilities in router-1.23.2.tgz used in MongoDB Enterprised Advanced for IBM, involving CVE-2026-40181. The vulnerability has been addressed. Vulnerability Details CVEID:CVE-2026-40181 DESCRIPTION: React Router is a router for React. In versions 7.0.0 through 7.14.0 and 6.7...

EUVD-2026-70698

Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly...

CVE-2026-53728 Medplum - Improper Validation of Redirect URI in External Auth Callback allows Authorization Code Leakage

Medplum is a developer platform that enables development of healthcare apps. Prior to version 5.1.6, the external identity provider callback at GET /auth/external accepts attacker-controlled redirect URIs that only need to start with a registered client redirect URI, rather than matching exactly...

EUVD-2026-70655

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...

CVE-2026-49456

Waku (the minimal React framework) prior to version 1.0.0-beta.1 is vulnerable to an open redirect via the unstable_redirect() helper in waku/router/server. The function reflects user-supplied strings unchanged into the HTTP Location header with no URL validation, scheme restriction, or path-only...

CVE-2026-49456 Waku: Open Redirect via `unstable_redirect` Helper

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...

CVE-2026-49456 Waku: Open Redirect via `unstable_redirect` Helper

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...

CVE-2026-49456 Waku: Open Redirect via `unstable_redirect` Helper

Waku is the minimal React framework. Prior to version 1.0.0-beta.1, the unstableredirect helper exported from waku/router/server packages/waku/src/router/define-router.tsx:156–161 accepts an arbitrary string and reflects it unchanged into the HTTP Location response header with no URL validation,...

EmailXpose — Updated!

EmailXpose Specification AI-Powered Email Clarity HTML Mirror: https://roxanneardary.com/emailxpose-specification/ Specification Overview EmailXpose is an open source, modular AI email security and intelligence system designed to analyze email content, sender identity, links, attachments, images,...

SUSE CVE-2026-18329

Description NGINX JavaScript njs and QuickJS qjs engines have a vulnerability when a jsaccess handler performs asynchronous request body processing and an exception is thrown during asynchronous access-control evaluation before an explicit access denial is returned. An unauthenticated attacker ca...

OPENSUSE-SU-2026:21795-1 Security update for python-Authlib

This update for python-Authlib fixes the following issues: Changes in python-Authlib: - CVE-2026-41479: Open Redirect vulnerability via crafted authorization requests bsc1275231...

Astra Linux – Vulnerability found in Linux 6.1, Linux 6.12

In the Linux kernel, the following vulnerability has been resolved: net: openvswitch: reject oversized nested action attrs Open vSwitch stores generated flow actions as nlattrs, where the nlalen field is of type u16. The vulnerability committed in a1e64addf3ff „net: openvswitch: remove misbehavin...

CVE-2026-78000

Joomla Extension - j2commerce.com - Reflected XSS via filtertag, pricefrom and priceto in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the...

CVE-2026-78000 Joomla Extension - j2commerce.com - Open redirect in cart controller in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5

Joomla Extension - j2commerce.com - Reflected XSS via filtertag, pricefrom and priceto in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - Four task handlers accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the...

CVE-2026-78000

J2Store , a Joomla e-commerce extension by j2commerce.com , is affected by two related issues. Four task handlers in the cart controller accepted a base64-encoded URL from user input and redirected to it without validating the destination host, enabling phishing using the shop's trusted domain (o...