CVE-2026-1111 Sanluan PublicCMS Task Template Management TaskTemplateAdminController.java save path traversal

A vulnerability has been found in Sanluan PublicCMS up to 5.202506.d. This impacts the function Save of the file com/publiccms/controller/admin/sys/TaskTemplateAdminController.java of the component Task Template Management Handler. Such manipulation of the argument path leads to path traversal. T...

PT-2026-3380

Name of the Vulnerable Software and Affected Versions Sanluan PublicCMS versions prior to 5.202506.d Description A flaw exists in Sanluan PublicCMS that allows for path traversal. This issue stems from manipulation of the path argument within the Save function located in the file...

PublicCMS path traversal vulnerability

PublicCMS is an open-source content management system CMS developed by PublicCMS Company in China, written in the Java language. Versions of PublicCMS 5.202506.d and earlier have a path traversal vulnerability. This vulnerability stems from incorrect handling of the path parameter in the function...

CVE-2026-1111: Improper Limitation of a Pathname to a Restricted Directory

A vulnerability has been found in Sanluan PublicCMS up to 5.202506.d. This impacts the function Save of the file com/publiccms/controller/admin/sys/TaskTemplateAdminController.java of the component Task Template Management Handler. Such manipulation of the argument path leads to path traversal. T...

CVE-2026-0863: Improper Neutralization of Directives in Dynamically Evaluated Code

Using string formatting and exception handling, an attacker may bypass n8n's python-task-executor sandbox restrictions and run arbitrary unrestricted Python code in the underlying operating system. The vulnerability can be exploited via the Code block by an authenticated user with basic permissio...

Insertion of Sensitive Information into Log File

Overview apache-airflow-task-sdk is a The Apache Airflow Task SDK includes interfaces for Dag authors and Task execution logic for Python. Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the proxies and proxy fields in a Connection. An...

Improper Removal of Sensitive Information Before Storage or Transfer

Overview apache-airflow-task-sdk is a The Apache Airflow Task SDK includes interfaces for Dag authors and Task execution logic for Python. Affected versions of this package are vulnerable to Improper Removal of Sensitive Information Before Storage or Transfer via the serialization for rendered...

Apache Airflow proxy credentials for various providers might leak in task logs

In Apache Airflow versions before 3.1.6, and 2.11.1 the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore were not automatically masked in log output. As a result,...

CVE-2025-68675

Apache Airflow versions before 3.1.6 and 2.11.1 are vulnerable to an information disclosure flaw where proxy credentials can be leaked. The root cause is that proxies and proxy fields within a Connection were not treated as sensitive by default, causing them to be included in log outputs without ...

EUVD-2026-2912

In Apache Airflow versions before 3.1.6, the proxies and proxy fields within a Connection may include proxy URLs containing embedded authentication information. These fields were not treated as sensitive by default and therefore were not automatically masked in log output. As a result, when such...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-004288)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-004288 advisory. In the Linux kernel, the following vulnerability has been resolved: parisc: led: Fix potential null-ptr-deref in starttask starttask calls createsinglethreadworkqueu...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000853)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000853 advisory. The pagemapopen function in fs/proc/taskmmu.c in the Linux kernel before 3.19.3, as used in Android 6.0.1 before 2016-03-01, allows local users to obtain sensitive...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: kernel (UTSA-2026-000811)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-000811 advisory. drivers/infiniband/ulp/srpt/ibsrpt.c in the Linux kernel before 4.5.1 allows local users to cause a denial of service NULL pointer dereference and system crash by...

scsi: target: Reset t_task_cdb pointer in error case

...

SUSE CVE-2025-68782

In the Linux kernel, the following vulnerability has been resolved: scsi: target: Reset ttaskcdb pointer in error case If allocation of cmd-ttaskcdb fails, it remains NULL but is later dereferenced in the 'err' path. In case of error, reset NULL ttaskcdb value to point at the default fixed-size...

PT-2026-3231

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.1.6 Description When rendered template fields in a Dag exceed max templated field length, sensitive values could be exposed in cleartext in the Rendered Templates UI. This is due to the serialization of these...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-003110)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-003110 advisory. Race condition in the gettaskioprio function in block/ioprio.c in the Linux kernel before 4.6.6 allows local users to gain privileges or cause a denial of service...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002839)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002839 advisory. drivers/infiniband/ulp/srpt/ibsrpt.c in the Linux kernel before 4.5.1 allows local users to cause a denial of service NULL pointer dereference and system crash by...

PT-2026-3232

Name of the Vulnerable Software and Affected Versions Apache Airflow versions prior to 3.1.6 Description Apache Airflow versions before 3.1.6 did not properly handle sensitive information within proxy URLs in Connection objects. Specifically, proxy credentials embedded in the proxies and proxy...

Unity Linux 20.1060a / 20.1070a Security Update: kernel (UTSA-2026-002391)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-002391 advisory. The archduptaskstruct function in the Transactional Memory TM implementation in arch/powerpc/kernel/process.c in the Linux kernel before 3.13.7 on the powerpc platfo...