PT-2026-86931

Name of the Vulnerable Software and Affected Versions knowns versions prior to 0.30.0 Description An issue exists where unauthenticated attackers can read arbitrary files by supplying directory traversal sequences in the templateFile parameter. This occurs via the 'POST /api/templates/preview'...

CVE-2026-86342: Missing Authorization

Affected versions of MISP contain improper authorization checks in the freetext feed preview functionality. The preview performed correlation lookups against attributes from events without applying the requesting user's ACL, allowing restricted event correlations and associated event information ...

security-report-for-ruoyi-dictionary-preview-stored-xss

RuoYi 4.8.3 Dictionary Preview Stored XSS English security ad...

PT-2026-86323

The Beaver Builder Plugin Starter Version plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via 'no results message' node preview Parameter in all versions up to, and including, 2.11.0.1 due to insufficient input sanitization and output escaping. This makes it possible for...

Important: Red Hat Security Advisory: Technical preview of the satellite/iop-vmaas-rhel9 container image

A new satellite/iop-vmaas-rhel9 container image is now available as a technical preview in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running...

Important: Red Hat Security Advisory: Technical preview of the satellite/iop-vmaas-rhel9 container image

A new satellite/iop-vmaas-rhel9 container image is now available as a technical preview in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages, running...

Important: Red Hat Security Advisory: satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview

A new satellite/iop-vulnerability-engine-rhel9 container image is now available as a Technology Preview in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages...

Important: Red Hat Security Advisory: satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview

A new satellite/iop-vulnerability-engine-rhel9 container image is now available as a Technology Preview in the Red Hat container registry. Red Hat Lightspeed in Satellite analyzes system health and configuration by applying predefined rules to a small set of local data, such as installed packages...

agent-skills v0.4.0

Elastic Agent Skills Elastic Agent Skills — built by the people who built Elastic — deliver native platform expertise directly to your AI coding agent. This is the official Agent Skills library, compatible with agentic IDEs such as Cursor, GitHub Copilot, Windsurf, Gemini CLI, and more. Skills...

EUVD-2026-63439

link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897...

link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897

The existing advisory GHSA-4gp8-rjrq-ch6q / CVE-2026-43897 states that the SSRF issue was fixed in 4.0.1. However, 4.0.3 remains bypassable when the documented resolveDNSHost mitigation is used. Root cause: The library validates one resolved IP address through resolveDNSHost, but later performs...

NPM: link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897

NPM: link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897 vulnerability discovered by ? in WordPress Npm link-preview-js versions = 4.0.3...

GHSA-CPJF-6666-R8FX link-preview-js DNS Rebinding SSRF Bypass / Incomplete Fix for CVE-2026-43897

The existing advisory GHSA-4gp8-rjrq-ch6q / CVE-2026-43897 states that the SSRF issue was fixed in 4.0.1. However, 4.0.3 remains bypassable when the documented resolveDNSHost mitigation is used. Root cause: The library validates one resolved IP address through resolveDNSHost, but later performs...

@kaikybrofc/zyra (0.2.4) potentially affected by CVE-2026-61704 via link-preview-js (4.0.3)

link-preview-js NPM version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on link-preview-js and may be impacted: - @kaikybrofc/zyra 0.2.4 Source cves: CVE-2026-61704 Source advisory: OSV:GHSA-CPJF-6666-R8FX...

@kaikybrofc/zyra (0.2.4) potentially affected by CVE-2026-43897 +1 more via link-preview-js (4.0.3)

link-preview-js NPM version 4.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on link-preview-js and may be impacted: - @kaikybrofc/zyra 0.2.4 Source cves: CVE-2026-43897, CVE-2026-61704 Source advisory: GHSA-CPJF-6666-R8FX...

Sulu: Fix authorization bypass when creating preview links

Impact A missing authorization check on the preview link endpoint lets a backend user create a public, unauthenticated preview URL for content they are not allowed to see. PreviewLinkController and the underlying PreviewLinkManager::generate / revoke never enforced a permission on the target...

EUVD-2026-68887

Sulu: Fix authorization bypass when creating preview links...

GHSA-65CV-W493-7VHQ Sulu: Fix authorization bypass when creating preview links

Impact A missing authorization check on the preview link endpoint lets a backend user create a public, unauthenticated preview URL for content they are not allowed to see. PreviewLinkController and the underlying PreviewLinkManager::generate / revoke never enforced a permission on the target...

Malicious code in arm-package-deploymentscripts-2019-10-preview (npm)

Source: ossf-package-analysis 036de74aa3f36e7c65b0ae918b5cbc8dad256bac711320dbded5935ef0d48657 The OpenSSF Package Analysis project identified 'arm-package-deploymentscripts-2019-10-preview' @ 8.0.1 npm as malicious. It is considered malicious because: - The package communicates with a domain...

Malicious Package

Overview arm-package-deploymentscripts-2019-10-preview is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that...