CVE-2026-48033: Protection Mechanism Failure

Hulumi is an open-source toolkit that ships secure-by-default cloud and platform infrastructure components for Pulumi. Prior to version 1.4.0, policy packs can be bypassed by a forged Pulumi-URN logical name. This issue has been patched in version 1.4.0...

The vulnerability of the console-based graphic editor ImageMagick, related to insufficient protection of operational data, allows a intruder to gain unauthorized access to protected information.

The vulnerability of the console-based graphic editor ImageMagick is related to insufficient protection of service data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

CVE-2026-65607

SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler kernel/server/serve.go. Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the...

CVE-2026-65607 SiYuan before v3.7.2 Path Traversal via /export/temp/

SiYuan before v3.7.2 contains a path traversal vulnerability in the /export/temp/ short-circuit branch of the serveExport handler kernel/server/serve.go. Unlike the main export branch, this branch joins the raw, percent-decoded request path with util.TempDir and serves the file without the...

Prompty: Arbitrary file read via file reference expansion

SummaryPrompty loaders expanded $file:... references in .prompty frontmatter without enforcing that the resolved path stayed within an authorized directory. An attacker-controlled prompt file could use path traversal or an absolute path to cause the host application to read files accessible to th...

PYSEC-2026-3519 PraisonAI: Jobs webhook SSRF protection bypass via DNS rebinding

Jobs webhook SSRF protection bypass via DNS rebinding Summary PraisonAI's Async Jobs API validates webhookurl when a job request is parsed and again when the internal Job object is constructed. That validation blocks direct loopback/private targets, but it is not bound to the later network reques...

RLSA-2026:41897 Important: .NET 10.0 security, bug fix, and enhancement update

.NET is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR implementation. New versions of .NET that address a security vulnerability are now available. The updated versions are .NET SDK 10.0.110 and .NET Runtime 10.0.10...

MZ Automation libIEC61850

ADVISORY SUMMARY Successful exploitation of these vulnerabilities could allow an unauthenticated network-adjacent attacker to crash critical IEC 61850 services or execute arbitrary code, disrupting or compromising protection, visibility, and control functions. 2. RECOMMENDED PRACTICES CISA...

ROS-20260723-73-0058

The vulnerability in Chromium is related to a violation of data protection mechanisms. Exploiting this vulnerability allows an attacker who operates remotely to circumvent existing security restrictions...

ROS-20260723-73-0049

The vulnerability in Chromium is related to a violation of data protection mechanisms. Exploiting this vulnerability allows an attacker who operates remotely to circumvent existing security restrictions...

ROS-20260723-73-0045

The vulnerability in Chromium is related to a violation of data protection mechanisms. Exploiting this vulnerability allows an attacker who operates remotely to circumvent existing security restrictions...

ROS-20260723-73-0057

The vulnerability in Chromium is related to a violation of data protection mechanisms. Exploiting this vulnerability allows an attacker who operates remotely to circumvent existing security restrictions...

The vulnerability of the Glances monitoring tool lies in the lack of protection for service data, allowing attackers to gain unauthorized access to protected information.

The vulnerability of the Glances monitoring tool is related to the lack of protection for service data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

The vulnerability of the Zabbix Agent 2 component of the Zabbix IT-infrastructure monitoring system allows a perpetrator to gain unauthorized access to protected information.

The vulnerability of the Zabbix Agent 2 component of the Zabbix IT infrastructure monitoring system is related to insufficient protection for registration data. Exploiting this vulnerability can allow an attacker operating remotely to gain unauthorized access to protected information...

The vulnerability of the Dovecot mail server, related to insufficient protection of service data, allows attackers to gain unauthorized access to protected information.

The vulnerability of the Dovecot mail server is related to insufficient protection of service data. Exploiting this vulnerability can allow an attacker, operating remotely, to gain unauthorized access to protected information...

RockyLinux 9 : .NET 10.0 (RLSA-2026:41898)

The remote RockyLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RLSA-2026:41898 advisory. dotnet: SocketsHttpHandler Http2Connection - HTTP/2 SETTINGS/PING ACK flood causing OOM CVE-2026-50651 dotnet: .NET Core: Denial of Service via type...

Oracle Linux 10 : kernel (ELSA-2026-19569)

The remote Oracle Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-19569 advisory. - crypto: ccp - copy IV using skcipher ivsize CKI Backport Bot RHEL-188463 CVE-2026-53016 - futex/requeue: Revert 'Prevent NULL pointer dereference i...

Server-side Request Forgery (SSRF)

Overview @n8n/n8n-nodes-langchain is a Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the MCP Client. An attacker can access internal or otherwise restricted network resources by supplying crafted endpoints, causing the server to connect to unintended host...

Server-side Request Forgery (SSRF)

Overview n8n is a n8n Workflow Automation Tool Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the /rest/dynamic-node-parameters/ endpoint due to insufficient authorization checks and the ability to supply an absolute URL in the routing configuration. An...

Missing Authorization

Overview kibana is an open source Apache Licensed, browser-based analytics and search dashboard for Elasticsearch. Affected versions of this package are vulnerable to Missing Authorization via direct requests to insufficiently protected product endpoints. An attacker can access and modify...