PT-2026-89145

An issue in GPAC c2dee3aff638cd96f9617ac5b17dc2868cd90ef3 allows an attacker to cause a denial of service via the function gf route media complete object. Fixed in 3c4e6c5b3e0c6fa9b16d55599701a08354538fab...

CVE-2026-53933

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was compiled with dynamic placeholders e.g., /api/v1/users/id, the raw string placeholder key was mistakenly registered into the flat static route...

CVE-2026-53933 Maravel-Framework Vulnerable to Side-Channel Information Disclosure (Error Oracle) via Dynamic Route Fuzzing

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was compiled with dynamic placeholders e.g., /api/v1/users/id, the raw string placeholder key was mistakenly registered into the flat static route...

EUVD-2026-74283

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was compiled with dynamic placeholders e.g., /api/v1/users/id, the raw string placeholder key was mistakenly registered into the flat static route...

CVE-2026-53933 Maravel-Framework Vulnerable to Side-Channel Information Disclosure (Error Oracle) via Dynamic Route Fuzzing

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was compiled with dynamic placeholders e.g., /api/v1/users/id, the raw string placeholder key was mistakenly registered into the flat static route...

CVE-2026-53933

Maravel , a PHP dependency-injection framework, is vulnerable to side-channel information disclosure via dynamic route fuzzing in versions prior to 10.73.1 . When routes are compiled with dynamic placeholders (e.g., /api/v1/users/{id}), the raw placeholder key is mistakenly registered into the fl...

CVE-2026-86077 n8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed a paused execution without checking that the target node supported chat messages. An anonymous form submitter who received that token could reuse it on the...

CVE-2026-80219

CVE-2026-80219 was rejected by Red Hat Product Security as "not needed," yet the underlying flaw is well documented in the hawtio-operator for OpenShift. When Hawtio is deployed in cluster mode, the operator creates a cluster-scoped OAuthClient with automatic grant approval (GrantMethod: auto) an...

PT-2026-88514

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was compiled with dynamic placeholders e.g., /api/v1/users/id, the raw string placeholder key was mistakenly registered into the flat static route...

PT-2026-88508

Impact The /chat WebSocket route resumed a paused execution from a resume token without checking that the node being resumed was a chat node. n8n hands that token to anonymous form submitters, so a party with no account could present it on the chat route and release an execution waiting at an...

EulerOS 2.0 SP12 : radvd (EulerOS-SA-2026-3381)

According to the versions of the radvd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the radvdump utility shipped with radvd contains a stack buffer overflow in...

EulerOS 2.0 SP12 : radvd (EulerOS-SA-2026-3306)

According to the versions of the radvd packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : radvd is a router advertisement daemon for IPv6. Prior to version 2.21, the radvdump utility shipped with radvd contains a stack buffer overflow in...

CVE-2026-53933: Observable Discrepancy

Maravel, a PHP framework oriented towards dependency injection, prior to version 10.73.1 has a side-channel information disclosure issue. When a route was compiled with dynamic placeholders e.g., /api/v1/users/id, the raw string placeholder key was mistakenly registered into the flat static route...

CVE-2026-86077: Missing Authorization

n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed a paused execution without checking that the target node supported chat messages. An anonymous form submitter who received that token could reuse it on the...

CVE-2026-82754

An Improper Protection of Alternate Path vulnerability in the ash_authentication_oauth2_server Elixir library (versions 0.1.0 through before 0.3.1) causes state-changing OAuth endpoints to be reachable under an unintended URL prefix. The oauth2_server_protocol_routes/1 function in the Phoenix rou...

CVE-2026-86332 Odh-dashboard: odh-dashboard: nim credential secret readable by any authenticated user

A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard...

CVE-2026-86332

A flaw in the odh-dashboard component of Red Hat OpenShift AI allows any authenticated dashboard user to read Kubernetes Secrets without an authorization check. The backend-for-frontend route GET /api/nim-serving/:nimResource uses the dashboard service account to retrieve and return the full Secr...

PT-2026-86661

A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the dashboard service account and returns the full Secret object, including .data, without an authorization check. Any authenticated dashboard...

Unity Linux 20.1050a Security Update: kernel (UTSA-2026-053271)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-053271 advisory. In the Linux kernel, the following vulnerability has been resolved: ipvs: fix ipv4 null-ptr-deref in route error path The IPv4 code path in ipvsgetoutrt calls...

Linux Distros Unpatched Vulnerability : CVE-2026-57161

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PJSIP is a free and open source multimedia communication library written in C. Prior to commit acc03b5, a stack buffer overflow exists in PJSUA when processing...