CVE-2026-96446: Missing Authorization

A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used, which allows the authorization process to skip certain steps if a user is already logged in. Due to this bypass, the security rule that...

PT-2026-97287

Name of the Vulnerable Software and Affected Versions Keycloak affected versions not specified Description A flaw exists in the Pushed Authorization Request PAR implementation. When the silent authentication path prompt=none is used, the authorization process may skip specific steps for users who...

CVE-2026-93690

A flaw was found in uri-js. A remote attacker can exploit a vulnerability in the removeDotSegments function by providing a specially crafted path segment that begins with Unicode line or paragraph separators. This can cause an infinite loop, leading to the Node.js event loop blocking indefinitely...

CVE-2026-93600

A flaw was found in rustls-webpki where the library incorrectly ignores X.509 name constraints that apply to Uniform Resource Identifier URI names. This issue causes these constraints to be accepted rather than properly enforced. Exploitation requires a misissued certificate and successful...

CVE-2026-93751

A flaw was found in uri-js. This improper UTF-8 Unicode Transformation Format - 8-bit decoding vulnerability in the pctDecChars function allows a remote attacker to craft specially encoded payloads. These payloads can bypass platform decoder validation, leading to the injection of path traversal ...

SUSE CVE-2026-93600

rustls-webpki rustls/webpki versions 0.101.0 through 0.103.11 and 0.104.0-alpha releases before 0.104.0-alpha.6 ignore X.509 name constraints that apply to URI names, causing such constraints to be accepted rather than enforced. Because name constraints are restrictions on otherwise properly issu...

CVE-2026-79315

A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-side template binding expression used for sidebar menu highlighting. Server-side HTML entity escaping is ineffective in this context: the browser decodes the...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.20.39 security and extras update

Red Hat OpenShift Container Platform release 4.20.39 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.20. Red Hat Product Security has rated this update as having a security impact of...

Security Bulletin: Multiple vulnerabilities in IBM DevOps Solution Workbench

Summary Multiple vulnerabilities were addressed in IBM DevOps Solution Workbench version 5.2.2 Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a second time...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.22.15 security and extras update

Red Hat OpenShift Container Platform release 4.22.15 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.22. Red Hat Product Security has rated this update as having a security impact of...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.21.34 security and extras update

Red Hat OpenShift Container Platform release 4.21.34 is now available with updates to packages and images that fix several bugs. This release includes a security update for Red Hat OpenShift Container Platform 4.21. Red Hat Product Security has rated this update as having a security impact of...

CVE-2026-79315

A reflected cross-site scripting vulnerability exists in x-ui 0.3.2. The management interface reflects the raw request URI into a client-side template binding expression used for sidebar menu highlighting. Server-side HTML entity escaping is ineffective in this context: the browser decodes the...

Security Bulletin: Security vulnerabilities have been found in IBM Verify Identity Access Digital Credentials

Summary Security vulnerabilities have been addressed in IBM Verify Identity Access Digital Credentials Vulnerability Details CVEID:CVE-2026-75899 DESCRIPTION: fast-uri is a URI parser for Node.js. It decodes percent escapes in a hostname during parsing and then decodes the parsed hostname a secon...

CLSA-2026-1790016280 TuxCare security update for fast-uri (3 CVEs)

TuxCare rebuilt fast-uri to address 3 CVEs. Fixed in 3.0.3-tuxcare.3...

CVE-2026-61749 InvenTree: Administrative staff users can trigger Arbitrary File Read leading to Credential Disclosure

InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, privileged staff users who can author report or label templates can cause WeasyPrint report rendering to retrieve attacker-selected resources through the HTTP and HTTPS URL schemes or the local file URI scheme. The...

Security Bulletin: IBM InfoSphere Optim Archive Viewer is affected by a vulnerability in fast-uri (CVE-2026-6322)

Summary An IPv6 parsing validation bypass vulnerability in the fast-uri library CVE-2026-6322 used by IBM InfoSphere Optim Archive Viewer has been addressed by upgrading the component to version 3.1.5. Vulnerability Details CVEID:CVE-2026-6322 DESCRIPTION: fast-uri normalize decoded percent-encod...

PT-2026-96030

Name of the Vulnerable Software and Affected Versions QCMS versions prior to 6.0.7 Description A remote SQL injection exists in the Content Detail Page component within the self Tmp function located in the Lib/Config/Controllers.php library. The issue occurs when the ID argument is manipulated...

Linux Distros Unpatched Vulnerability : CVE-2026-93690

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - uri-js through 4.4.1 contains a denial of service vulnerability in the removeDotSegments function that loops infinitely when a path segment begins with Unicode...

CVE-2026-36472: Improper Neutralization of Input During Web Page Generation

CuteNews v.2.1.2 is vulnerable to Cross Site Scripting XSS. Improper neutralization of the referer value 2.0.1 allows a remote attacker to execute arbitrary JavaScript in the context of an authenticated user's session via a javascript: URI rendered as an unsanitized clickable link on the msginfo...

SUSE SLES12 Security Update : perl-URI (SUSE-SU-2026:4070-1)

The remote SUSE Linux SLES12 / SLESSAP12 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4070-1 advisory. This update for perl-URI fixes the following issue: - CVE-2026-19953: non-NFC host names encoded to non-standard punycode labels due to...