CVE-2026-1895 WeKan Attachment Storage lists.js applyWipLimit ListWIPBleed access control

A flaw has been found in WeKan up to 8.20. Affected is the function applyWipLimit of the file models/lists.js of the component Attachment Storage Handler. Executing a manipulation can lead to improper access controls. The attack can be executed remotely. Upgrading to version 8.21 is able to addre...

CVE-2026-1895

CVE-2026-1895 affects WeKan up to version 8.20, specifically the Attachment Storage Handler’s file models/lists.js , function applyWipLimit . The vulnerability arises from a manipulation that can lead to improper access controls and can be exploited remotely. The advisory states that upgrading to...

CVE-2026-1895

A flaw has been found in WeKan up to 8.20. Affected is the function applyWipLimit of the file models/lists.js of the component Attachment Storage Handler. Executing a manipulation can lead to improper access controls. The attack can be executed remotely. Upgrading to version 8.21 is able to addre...

CVE-2026-25584

creationtimestamp| type| source ---|---|--- 2026-02-04 22:17:27+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me2vpwhl3j23 2026-02-04 22:17:49+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me2vqlgsmw2o...

CVE-2026-25536 @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.10.0 to 1.25.3, cross-client response data leak when a single McpServer/Server and transport instance is reused across multiple client connections, most commonly in stateless...

CVE-2026-25523

Magento-lts versions prior to 20.16.1 are affected: the admin URL can be discovered without prior knowledge by exploiting the X-Original-Url header in certain configurations. The root cause is exposure via the X-Original-Url header; patches exist and are applied in version 20.16.1. Several connec...

CVE-2026-0536

creationtimestamp| type| source ---|---|--- 2026-02-04 19:17:10+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3me2lnko56g23...

CVE-2026-23078

creationtimestamp| type| source ---|---|--- 2026-02-04 17:25:12+00:00| seen| https://infosec.exchange/users/vuldb/statuses/116013525368336436 2026-03-19 00:00:00+00:00| seen| https://www.cert.ssi.gouv.fr/avis/CERTFR-2026-AVI-0316/ 2026-04-07 18:00:00+00:00| seen|...

EUVD-2026-5375

GLPI is a free asset and IT management software package. From version 0.85 to before 10.0.23, an authenticated user can perform a SQL injection. This issue has been patched in version 10.0.23...

CVE-2026-20401

creationtimestamp| type| source ---|---|--- 2026-02-04 15:17:07+00:00| seen| Telegram/dDHVryIUgTB0bl9EUy2cYsSqKLSHmbXCLC2CE7zqR15ujSM...

PT-2026-6303

Name of the Vulnerable Software and Affected Versions Group-Office versions prior to 6.8.150 Group-Office versions prior to 25.0.82 Group-Office versions prior to 26.0.5 Description An authenticated user with System Administrator privileges can trigger a server-side request forgery SSRF through t...

Ubuntu: Security Advisory (USN-7995-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WeKan 授权问题漏洞

WeKan is an open-source dashboard application developed by WeKan. Versions of WeKan prior to 8.20 contained a vulnerability related to authorization issues. This vulnerability arose from improper authorization handling when operating on the parameters item.cardId, item.checklistId, and card.board...

java-21-openj9-21.0.10.0-1.1 on GA media (moderate)

java-21-openj9-21.0.10.0-1.1 on GA media Announcement ID: openSUSE-SU-2026:10137-1 Rating: moderate Cross-References: CVE-2026-21925 CVE-2026-21933 CVSS scores: CVE-2026-21925 SUSE : 4.8 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N CVE-2026-21933 SUSE : 6.1...

nodejs22 security update

1:22.22.0-3 - Bump release to get correct RHEL build 1:22.22.0-2 - Filter for nodejs22.fmf in gating plan 1:22.22.0-1 - Update to 22.22.0 1:22.19.0-3 - Unit-tests adjustment - disable internet/test-dgram-membership...

SUSE SLED15: java-21-openjdk / java-21-openjdk-demo / java-21-openjdk-devel / etc (SUSE-SU-2026:0363-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:0363-1 advisory. Update to upstream tag jdk-21.0.10+7 January 2026 CPU Security fixes: - CVE-2026-21925: Fixed...

CVE-2026-0620

When configured as L2TP/IPSec VPN server, Archer AXE75 V1 may accept connections using L2TP without IPSec protection, even when IPSec is enabled. This allows VPN sessions without encryption, exposing data in transit and compromising confidentiality...

CVE-2026-25022

creationtimestamp| type| source ---|---|--- 2026-02-03 15:19:37+00:00| seen| https://bsky.app/profile/thehackerwire.bsky.social/post/3mdxnvuatkh2m...

CVE-2025-14550 Potential denial-of-service vulnerability via repeated headers when using ASGI

An issue was discovered in 6.0 before 6.0.2, 5.2 before 5.2.11, and 4.2 before 4.2.28. ASGIRequest allows a remote attacker to cause a potential denial-of-service via a crafted request with multiple duplicate headers. Earlier, unsupported Django series such as 5.0.x, 4.1.x, and 3.2.x were not...

SUSE-SU-2026:0363-1 Security update for java-21-openjdk

This update for java-21-openjdk fixes the following issues: Update to upstream tag jdk-21.0.10+7 January 2026 CPU Security fixes: - CVE-2026-21925: Fixed Oracle Java SE component RMI bsc1257034. - CVE-2026-21932: Fixed Oracle Java SE component AWT and JavaFX bsc1257036. - CVE-2026-21933: Fixed...