PT-2026-78239

Name of the Vulnerable Software and Affected Versions Streambert versions prior to 2.6.0 Description Streambert is a cross-platform Electron Desktop App used for streaming and downloading video content. The open-external IPC handler in src/ipc/downloads.js passes a renderer-supplied url directly ...

PT-2026-77620

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM Integration versions 25.12 through 26.6 Description A flaw in the Open Integration component allows a low privileged attacker with network access via HTTP to compromise the system. This issue can lead to unauthorized access t...

PT-2026-78236

Name of the Vulnerable Software and Affected Versions Streambert versions 2.5.0 through 2.5.9 Description Streambert is a cross-platform Electron Desktop App used for streaming and downloading video content. The wyzie-open-redeem IPC handler in index.js creates a partition:wyzie-redeem Electron...

PT-2026-77623

Name of the Vulnerable Software and Affected Versions Oracle Siebel CRM Integration versions 25.12 through 26.6 Description An issue exists in the Open Integration component of Oracle Siebel CRM Integration. A low privileged attacker with network access via HTTP can compromise the system,...

Amazon Linux 2023 : iscsi-initiator-utils, iscsi-initiator-utils-devel, iscsi-initiator-utils-iscsiuio (ALAS2023-2026-2066)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2023-2026-2066 advisory. An Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in open- iscsi allows remote MITM attackers to create root-owned files outside the database and...

CVE-2026-75110

MemOS is a memory operating system for LLMs and AI agents. In deployments where authentication is enabled AUTHENABLED=true but the undocumented, defaultless INTERNALSERVICESECRET environment variable is unset, the isinternalrequest check in src/memos/api/middleware/auth.py fails open:...

CVE-2026-40506

OpenEMR before 8.2.0 contains a path traversal vulnerability in the standardtablesmanage.php interface where the db GET parameter is passed without validation to tempdircleanup, which joins the value to the PHP temporary directory path and recursively deletes the resulting directory. Attackers ca...

EUVD-2026-60396

OpenEMR before 8.2.0 contains a path traversal vulnerability in the standardtablesmanage.php interface where the db GET parameter is passed without validation to tempdircleanup, which joins the value to the PHP temporary directory path and recursively deletes the resulting directory. Attackers ca...

GHSA-X88Q-X2R7-VG3G vulnerabilities

Vulnerabilities for packages: nginx-stable, nginx-mainline...

UBUNTU-CVE-2026-68520

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, asdictsecure in glances/config.py checks only option names and exposes publicusername and credentials embedded in publicapi values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This iss...

ANT-2026-QXNF2N9K · rocketchat · Authentication-bypass

auth-bypass high CVE-2026-48929 Severity Claude high · Security research firm high · Maintainer high Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ophion Security. ANT-2026-QXNF2N9K: Unauthenticated Arbitrary Fil...

UBUNTU-CVE-2026-68517

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the corsorigins guard in glances/outputs/glancesrestfulapi.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain corscredentials and expose...

CVE-2026-68517

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, the corsorigins guard in glances/outputs/glancesrestfulapi.py uses exact list equality instead of wildcard membership, allowing a multi-origin list containing the wildcard to retain corscredentials and expose...

CVE-2026-68518

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, sanitizemustachedict in glances/actions.py sanitizes individual Mustache values before chevron.render, allowing adjacent unescaped Mustache variables to reconstruct shell operators that securepopen executes when...

EUVD-2025-210735

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the /addprompts endpoint is vulnerable to remote code execution via the checks and metadata parameters. Any user that has access to UpTrain and a valid authentication method may be...

CVE-2025-27621

UpTrain ≤0.7.1 ships a static default API key derived from a hardcoded username and an open CORS policy, letting any website send authenticated cross-origin requests via the uptrain-access-token header and perform privileged actions. CVSS 8.7 HIGH. No patch is available; monitor the GitHub adviso...

EUVD-2025-210733

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a static username, where the username is also used as the default API key. The UpTrain backend also has an open CORS policy. Using...

CVE-2025-27621

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a static username, where the username is also used as the default API key. The UpTrain backend also has an open CORS policy. Using...

CVE-2025-27621 UpTrain has a Constant Default API Key

UpTrain is an open-source platform to evaluate and improve generative AI applications. In version 0.7.1 and prior, the UpTrain backend creates a new default user with a static username, where the username is also used as the default API key. The UpTrain backend also has an open CORS policy. Using...

CVE-2026-74464

A flaw was found in the Open vSwitch OVS component of the Linux kernel. This vulnerability occurs when a packet becomes unparseable during a flow key update operation. This can lead to a memory leak, potentially allowing a remote attacker to cause a denial of service by exhausting system resource...