PT-2026-67844

Name of the Vulnerable Software and Affected Versions Open WebUI versions prior to 0.11.0 Description An authenticated attacker can bypass URL validation to perform a DNS rebinding attack. The software validates hostnames by resolving them once to reject private, loopback, and link-local addresse...

PT-2026-73844

TuxCare rebuilt symfony/process to address 2 CVEs. Fixed in 3.4.47-p1+tuxcare...

PT-2026-69030

Name of the Vulnerable Software and Affected Versions OpenImageIO versions prior to 3.0.21.0 OpenImageIO versions prior to 3.1.16.0 OpenImageIO versions prior to 3.2.0.3-beta1 Description An issue exists when processing indexed PSD files with transparency metadata. When oiio:rawcolor or psd:rawda...

PT-2026-67766

Name of the Vulnerable Software and Affected Versions Flowise versions prior to 3.1.3 Description An authenticated attacker can execute arbitrary operating system commands as root within the container. The issue occurs in the CSVAgent within packages/components/nodes/agents/CSVAgent/CSVAgent.ts,...

PT-2026-73787

TuxCare rebuilt symfony/process to address 2 CVEs. Fixed in 4.4.44-p1+tuxcare...

PT-2026-67887

Name of the Vulnerable Software and Affected Versions Ghost versions 2.2.0 through 6.54.0 Description Ghost Admin fails to invalidate existing sessions during the login process, which could enable session fixation attacks. Session fixation is a method where an attacker provides a valid session...

PT-2026-73599

TuxCare rebuilt symfony/process to address 1 CVE. Fixed in 5.4.45-p1+tuxcare...

PT-2026-73779

TuxCare rebuilt symfony/process to address 1 CVE. Fixed in 6.4.13-p2+tuxcare...

PT-2026-73786

TuxCare rebuilt symfony/process to address 1 CVE. Fixed in 5.4.45-p2+tuxcare...

PT-2026-73600

TuxCare rebuilt symfony/process to address 1 CVE. Fixed in 6.4.13-p1+tuxcare...

SUSE SLES12 Security Update : perl-DBI (SUSE-SU-2026:3461-1)

The remote SUSE Linux SLES12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:3461-1 advisory. - CVE-2026-14380: unvalidated string eval interpolation of the Profile package name can lead to arbitrary Perl code execution bsc1271018. -...

CVE-2026-47746

CVE-2026-47746 affects Misskey (open source federated social platform). Affected versions are 12.37.0 and later, up to but not including 2026.5.4. The issue is a TOCTOU vulnerability in timing attacks during JSON-LD signature validation and the JSON-LD compaction process, caused by a non-shared p...

CVE-2025-15544 Weak Credential Protection During TP-Link Omada Device Adoption

A cryptographic weakness exists in the Omada device adoption process. During adoption, authentication credentials associated with site management are transmitted using a weak hashing algorithm that does not provide sufficient protection. An attacker who successfully intercepts adoption-related...

CVE-2026-18477

A TOCTOU Time-of-Check Time-of-Use vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During...

UBUNTU-CVE-2026-18477

A TOCTOU Time-of-Check Time-of-Use vulnerability in GNU tar's incremental dumpdir 'X' rename handling allows a local attacker with write access to a directory being backed up to influence the restore process if the attacker has access to the system where the restore is being performed. During...

Directory Traversal

Overview getgrav/grav is a Modern, Crazy Fast, Ridiculously Easy and Amazingly Powerful Flat-File CMS. Affected versions of this package are vulnerable to Directory Traversal via the watermark process. An attacker can access arbitrary image files outside the intended media directory by supplying...

Security update for perl-DBI

This update for perl-DBI fixes the following issues: CVE-2026-14380: unvalidated string eval interpolation of the Profile package name can lead to arbitrary Perl code execution bsc1271018. CVE-2026-14740: one-byte out-of-bounds read when deleting an initial SQL comment line can lead to a process...

SUSE-SU-2026:3461-1 Security update for perl-DBI

This update for perl-DBI fixes the following issues: - CVE-2026-14380: unvalidated string eval interpolation of the Profile package name can lead to arbitrary Perl code execution bsc1271018. - CVE-2026-14740: one-byte out-of-bounds read when deleting an initial SQL comment line can lead to a...

EUVD-2026-52166

The Import and export users and customers WordPress plugin before 2.4.2 does not enforce WordPress's role-assignment and per-user edit permissions during CSV import, allowing a user holding only the user-creation capability to create an administrator account and to overwrite an existing...

WebKit single-bug RCE: crafted web content yields AAR/AAW/PC-hijack in content process

Summary A memory-corruption vulnerability in Apple's WebKit engine is reachable from maliciously crafted web content. Apple's public advisory understates the impact as an "unexpected process crash" and notes it was addressed with improved memory handling. In practice the bug is a single-shot remo...