CVE-2026-63123 Tina: Cross-origin `POST /media/upload/*` requests can write arbitrary files into the Tina dev server media root

Tina is a headless content management system. Prior to 2.5.2, the TinaCMS CLI package's Vite dev server packages/@tinacms/cli/src/next/vite/cors.ts origin callback returns false for a disallowed origin but does not reject the request, and packages/@tinacms/cli/src/next/vite/plugins.ts still route...

CVE-2026-76332

Affected: Splunk Enterprise below 9.4.14, 10.0.9, 10.2.6, and 10.4.2. Root cause: Analytics Workspace fails to validate data used to build SPL searches. Impact: an unauthenticated attacker can phish an authenticated user via a crafted link; opening it executes attacker-controlled SPL with the vic...

CVE-2026-54492

Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createPodcastChannel.view route accepts an authenticated user's private URL because app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php does not apply the SafeUrl validation used by the regular...

CVE-2026-53549

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /host/db/proxy/test endpoint accepts the singleProxy, proxyChain, and testTarget request fields without validating their destination addresses. The...

GHSA-RXJR-6C9Q-H67X

creationtimestamp| type| source ---|---|--- 2026-08-19 21:16:30+00:00| seen| https://bsky.app/profile/thestandup.bsky.social/post/3mthnpgazgt2v...

EUVD-2026-63088

Koel is a free, open-source music streaming solution. Prior to 9.7.1, outbound podcast and radio fetch paths perform a point-in-time App\Helpers\Network::isPublicHost or isSafeUrl check without pinning the validated address, and most paths lack redirect-hop validation and do not revalidate every...

EUVD-2026-63085

Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createInternetRadioStation.view and updateInternetRadioStation.view routes accept an authenticated user's streamUrl without the SafeUrl and HasAudioContentType checks used by the regular radio API...

EUVD-2026-63082

Koel is a free, open-source music streaming solution. Prior to 9.7.0, the Subsonic-compatible createPodcastChannel.view route accepts an authenticated user's private URL because app/Http/Requests/Subsonic/CreatePodcastChannelRequest.php does not apply the SafeUrl validation used by the regular...

CVE-2026-53549 Termix: Server-Side Request Forgery via Proxy Connectivity Test

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /host/db/proxy/test endpoint accepts the singleProxy, proxyChain, and testTarget request fields without validating their destination addresses. The...

GHSA-5M9F-RPHJ-C435 vulnerabilities

Vulnerabilities for packages: logstash-fips, cassandra-reaper, nuxeo, thingsboard, traccar, zipkin, conductor-fips, traccar-fips, conductor, druid, logstash...

AZL-97035 CVE-2026-75593 affecting package moby-engine for versions less than 25.0.3-20

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to...

CVE-2026-63187

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pullrequest.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. ...

CVE-2026-75593

BuildKit is a toolkit for converting source code to build artifacts in an efficient, expressive and repeatable manner. Prior to 0.31.2, a custom client can produce such an upload request to the BuildKit daemon that files can escape from the BuildKit-controlled state directory. The client needs to...

EUVD-2026-62865

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pullrequest.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. ...

CVE-2026-63187

Logto (open-source auth infrastructure) versions 1.40.1 through 1.41.0 contain an OS command injection in the .github/workflows/commitlint.yml workflow. The github.event.pull_request.title value was directly interpolated into an inline echo command before being piped to npx commitlint. A pull req...

CVE-2026-63187 Logto: OS command injection vulnerability exists in the Commitlint workflow

Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.40.1 until 1.41.0, Logto's .github/workflows/commitlint.yml directly interpolated github.event.pullrequest.title into the Commitlint on PR title step's inline echo command before piping the title to npx commitlint. ...

CVE-2026-16687

IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in the ASMI web interface. An unauthenticated attacker with network access can send the FSP a malformed request, allowing arbitrary code...

Security Bulletin: IBM SPSS Analytic Server is affected by multiple vulnerabilities in Netty

Summary IBM SPSS Analytic Server is affected by multiple vulnerabilities in Netty. This has been addressed in the remediation section. Vulnerability Details CVEID:CVE-2026-59899 DESCRIPTION: Netty is an asynchronous, event-driven network application framework. Prior to versions 4.1.136.Final and...

CVE-2026-74505

A flaw was found in the ALSA 6fire driver within the Linux kernel. During error handling in the probe phase, the driver failed to properly manage a pending USB Request Block URB before freeing associated resources. This oversight could lead to a Use-After-Free UAF vulnerability. A local attacker...

CVE-2026-75583

keeper.sh's calendar module version prior to 2.18.14 contains a server-side request forgery SSRF guard bypass vulnerability that allows authenticated attackers to reach private network addresses by exploiting a DNS rebinding attack against the two-phase URL validation and connection flow. The SSR...