RHEL 9 : Satellite 6.19.4 Async Update (Important) (RHSA-2026:63385)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:63385 advisory. Red Hat Satellite is a system management solution that allows organizations to configure and maintain their systems without the necessity t...

PT-2026-85771

IBM Langflow OSS 1.0.0 through 1.10.2 could allow a remote authenticated attacker to obtain sensitive information due to a server-side request forgery SSRF vulnerability...

CVE-2026-85585: Uncontrolled Resource Consumption

SiYuan before v3.8.2 contains an unbounded resource consumption vulnerability in the request-concurrency middleware that retains mutex entries for every unique request path without eviction. Unauthenticated attackers can send numerous unique request paths to permanently increase process memory an...

CVE-2026-85673: Server-Side Request Forgery (SSRF)

LLaMA-Factory contains a server-side request forgery vulnerability in the OpenAI-compatible API multimodal media URL handler that allows unauthenticated attackers to bypass SSRF validation. The checkssrfurl guard validates URLs once but requests.get follows redirects and re-resolves DNS without...

PT-2026-85589

IBM Langflow OSS 1.0.0 through 1.11.2 allows an authenticated attacker to read arbitrary files from the server filesystem — including server secret material secret key, JWT signing keys, the application database, /proc/self/environ, and other tenants' upload directories — by supplying absolute...

CVE-2026-85665: Improper Limitation of a Pathname to a Restricted Directory

Bruno versions through 4.1.0 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments. When a collection is executed, attackers can craft a request with a body:file path containing ../ sequences that...

CVE-2026-79423

A remote code execution (RCE) vulnerability exists in the admin_config.php component of seacms v13.6 . The flaw allows an authenticated attacker to execute arbitrary code by sending a crafted POST request . This vulnerability is characterized as an Improper Neutralization of Special Elements used...

PT-2026-85559

Name of the Vulnerable Software and Affected Versions OGX formerly Llama Stack versions up to commit fbe8e0f Description An unauthenticated server-side request forgery SSRF exists in the OpenAI-compatible 'POST /v1/responses' endpoint. The issue occurs because MCP tool definitions accept a server...

PT-2026-85451

Name of the Vulnerable Software and Affected Versions fastify versions prior to 5.12.2 Description An issue exists where the object resolved by a successful Ajv async validator is treated as the value result protocol used by custom validator compilers. If a request that passes its route schema...

CVE-2026-84947: Improper Input Validation

undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead signals completion...

Linux Distros Unpatched Vulnerability : CVE-2026-66357

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - httpd has never implemented obs-fold RFC 2616 2.2 / RFC 7230 3.2.4 header continuation lines. Every CRLF followed by a non-CRLF octet unconditionally starts a n...

PT-2026-85689

Cross-Site Request Forgery CSRF in the OrderConfirmController at GET /order/confirm/order number in Roskus Prospero Flow CRM before 5.15.11 allows an unauthenticated attacker to confirm any order on behalf of an authenticated user by directing them to a crafted page. Laravel's VerifyCsrfToken...

CVE-2026-85693: Authorization Bypass Through User-Controlled Key

Chatbot UI contains an authorization bypass vulnerability in the retrieval endpoint that allows authenticated attackers to access private file content belonging to other users by supplying arbitrary file UUIDs. The endpoint uses a service-role Supabase client that bypasses row-level security and...

PT-2026-85558

Bruno versions through 3.4.2 fail to validate file paths in request body declarations, allowing attackers to read arbitrary local files by using parent-directory traversal segments. When a collection is executed, attackers can craft a request with a body:file path containing ../ sequences that...

CVE-2026-61688: Authorization Bypass Through User-Controlled Key

SolidInvoice is an open-source invoicing platform. Prior to version 3.0.1, an authenticated user can view the API request history of any other user's API tokens within the same company by manipulating two writable Symfony UX LiveComponent props on the DataGrid component. Version 3.0.1 fixes the...

CVE-2026-57160: Off-by-one Error

PJSIP is a free and open source multimedia communication library written in C. Prior to commit d6a0e7f, a buffer overflow can occur in pjsipgenericarrayhdrprint in pjsip/src/pjsip/sipmsg.c, the function that serializes generic array headers such as Allow, Require, Supported, and Unsupported. Unde...

PT-2026-85428

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery SSRF. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...

CVE-2026-80181: Server-Side Request Forgery (SSRF)

Apache Allura's webhooks are vulnerable to Server-Side Request Forgery SSRF. This issue affects Apache Allura: through 1.20.0. Users are recommended to upgrade to version 1.21.0, which fixes the issue...

CVE-2026-85695: Missing Authentication for Critical Function

FastChat contains an authentication bypass vulnerability in the /registerworker endpoint that allows unauthenticated attackers to register arbitrary worker addresses and perform server-side request forgery. Attackers can register malicious workers under victim model names to intercept user prompt...

CVE-2026-84947: Improper Input Validation

undici's dump interceptor reads and discards a response body up to a configurable maximum size. When a response declares a Content-Length that exceeds the maximum, the interceptor aborts cleanly, but when a response has no Content-Length and is chunked, the interceptor instead signals completion...