PT-2026-91221

Name of the Vulnerable Software and Affected Versions Mattermost version 11.9.0 Mattermost versions 11.8.0 through 11.8.4 Mattermost versions 11.7.0 through 11.7.7 Description An issue exists where the software fails to validate Dynamic Client Registration redirect URIs by URL component, instead...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS : CivetWeb vulnerabilities (USN-8749-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8749-1 advisory. It was discovered that CivetWeb did not correctly handle parsing certain URIs. A remote attacker could...

PT-2026-91153

Name of the Vulnerable Software and Affected Versions Apache Syncope versions 3.0.0-M0 through 3.0.16 Apache Syncope versions 4.0.0-M0 through 4.0.7 Apache Syncope versions 4.1.0-M0 through 4.1.2 Description Improper verification of cryptographic signatures occurs when Secure Remote Access SRA is...

CVE-2026-49846

libks provides foundational support for signalwire C products. Prior to version 2.0.11, cleanuri in libks's HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The canonicalization step silently passes such URIs through with...

CVE-2026-49846 libks has path traversal in kws HTTP parser via URI segment overflow

libks provides foundational support for signalwire C products. Prior to version 2.0.11, cleanuri in libks's HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The canonicalization step silently passes such URIs through with...

CVE-2026-49846 libks has path traversal in kws HTTP parser via URI segment overflow

libks provides foundational support for signalwire C products. Prior to version 2.0.11, cleanuri in libks's HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The canonicalization step silently passes such URIs through with...

CVE-2026-49846

libks , a foundational C library used by SignalWire products, contains a path traversal vulnerability in clean_uri(), its HTTP request parser. Prior to version 2.0.11 , URIs whose path exceeds the internal canonicalization buffer's segment capacity are silently passed through with embedded .. seq...

CVE-2026-49846 libks has path traversal in kws HTTP parser via URI segment overflow

libks provides foundational support for signalwire C products. Prior to version 2.0.11, cleanuri in libks's HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The canonicalization step silently passes such URIs through with...

PT-2026-89844

WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a reflected cross-site scripting vulnerability in confirmLivePassword.php that copies REQUEST URI into a form action attribute without encoding. Attackers can craft a malicious URL with a quote character to break out of...

PT-2026-90508

libks provides foundational support for signalwire C products. Prior to version 2.0.11, clean uri in libks's HTTP request parser fails to reject URIs whose path has more segments than its internal canonicalization buffer can hold. The canonicalization step silently passes such URIs through with...

fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization

A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode Internationalized Domain Name - IDN hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when...

CVE-2026-52097

An issue in AppFlowy 0.11.8 allows a remote attacker to execute arbitrary code via the afLaunchUri, afLaunchLocalUri urllauncher.dart, OpenFilex.open, localPathRegex commonpatterns.dart components...

fast-uri: fast-uri: Security policy bypass due to improper Unicode hostname canonicalization

A flaw was found in fast-uri. This vulnerability occurs because fast-uri fails to properly convert Unicode Internationalized Domain Name - IDN hostnames for HTTP-family URLs. This can lead to a situation where security policies, such as denylists or redirect validations, are bypassed when...

Security Bulletin: IBM Informix HQ affected by Vulnerabilities (CVE-2026-6790, CVE-2025-11143, and CVE-2026-2332) in third-party library Jetty.

Summary IBM InformixHQ is affected by several vulnerabilities in Jetty. IBM InformixHQ has been updated to use the latest Jetty release. Vulnerability Details CVEID:CVE-2026-6790 DESCRIPTION: In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request...

Security Bulletin: fast-uri versions from 2.3.1 through 4.1.0 (including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2) do not treat a literal backslash character (U+005C) as an authority delimiter

Summary Upgrade to InformixHQ 3.3.2 Vulnerability Details CVEID:CVE-2026-16221 DESCRIPTION: Impact: fast-uri versions from 2.3.1 through 4.1.0 including the 3.x line up to 3.1.3 and the 2.x line up to 2.4.2 do not treat a literal backslash character U+005C as an authority delimiter. Node's native...

CVE-2026-86754

Snipe-IT versions prior to 8.7.0 fail to properly gate Laravel Passport's OAuth client management routes , allowing any authenticated user to register OAuth clients with attacker-controlled redirect URIs. An attacker can trick an administrator into approving a consent screen, then exchange the re...

CVE-2026-86754 Snipe-IT before 8.7.0 Authorization Bypass via OAuth Clients

Snipe-IT before 8.7.0 fails to properly gate Laravel Passport's OAuth client management routes, allowing any authenticated user to register OAuth clients with attacker-controlled redirect URIs. Attackers can trick administrators into approving consent screens, then exchange authorization codes fo...

EUVD-2026-74795

Specifying tblproperties'avro.schema.url'=' http://...' or with a 'file:///' URI on a table in Impala 2.0.0 to 4.5.1 on all platforms allows an attacker to trigger a GET request to internal endpoints they may not have access to but that Impala does and the response my be exposed via parsing error...

openSUSE 16 Security Update : perl-URI (openSUSE-SU-2026:21773-1)

The remote openSUSE 16 host has a package installed that is affected by a vulnerability as referenced in the openSUSE- SU-2026:21773-1 advisory. This update for perl-URI fixes the following issue: - CVE-2026-19953: non-NFC host names encoded to non-standard punycode labels due to missing...

CVE-2026-28657

In onActivityResult of AppWidgetConfigActivityProxy.java, there is a possible unauthorized URI permission grant due to a confused deputy. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation...