EUVD-2026-67775

vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMediaIO.fetchaudio and AsyncMediaIO.fetchimage functions in multimodal/inputs.py fetch user-supplied media URLs using aiohttp and call r.read without enforcing a maximum response...

EUVD-2026-67774

Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL function...

PT-2026-83125

Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL function...

CVE-2026-37710: Improper Neutralization of Input During Web Page Generation

Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL function...

CVE-2026-37710

Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL function...

CVE-2026-50979

Osbil Technology oPanel (v1.19.50 and earlier) contains a command injection vulnerability in the /advanced/curl endpoint. The flaw exists because the application fails to properly sanitize user input provided to the url parameter before passing it to the underlying system curl routine. An authent...

PT-2026-83101

gitoxide before 0.38.2 fails to validate carriage return characters in URL values passed to credential helpers. Attackers can supply URLs containing bare carriage returns to inject additional helper protocol fields and cause credential helpers to return credentials for attacker-specified hosts...

WS-2026-0037

The Oxidized integration URL in LibreNMS is admin-configurable. LibreNMS fetches device info and version history from that URL and renders the returned JSON fields name, ip, model, author and commit message into HTML without escaping in includes/html/pages/device/showconfig.inc.php, so an...

openSUSE 16 Security Update : python-pip (openSUSE-SU-2026:21643-1)

The remote openSUSE 16 host has packages installed that are affected by a vulnerability as referenced in the openSUSE- SU-2026:21643-1 advisory. This update for python-pip fixes the following issue: - CVE-2026-13346: incorrect handling of doubly-encoded package URLs from malicious indexes allows...

CVE-2026-37237

vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMediaIO.fetchaudio and AsyncMediaIO.fetchimage functions in multimodal/inputs.py fetch user-supplied media URLs using aiohttp and call r.read without enforcing a maximum response...

PT-2026-83252

Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs processes attacker-controlled data from the /ext URL route in yamcs-web/src/main/webapp/projects/webapp/src/app/core/routes/extension.matcher.ts, extension.component.ts, and app.component.ts without checking registered plugin...

CVE-2026-82247: Insufficiently Protected Credentials

gitoxide's gix-url crate = 0.32.0, fixed in 0.37.1 uses a hand-rolled URL parser that does not treat '?' or '' as terminating the authority component, contrary to RFC 3986. As a consequence, gix-transport's HTTP redirect identity guard canreuseidentity compares the wrong host and fails open. An...

CVE-2026-55834: URL Redirection to Untrusted Site

Pocket ID is an OIDC provider that allows users to authenticate with their passkeys to services. From 2.6.0 until 2.9.0, frontend/src/routes/authorize/+page.ts reads the redirecturi query parameter and frontend/src/routes/authorize/+page.svelte uses the raw callbackURL in redirectWithError when...

PT-2026-83155

Medical Practice Management System developed by Le-yan has a Sensitive Data in URL vulnerability. Unauthenticated remote attackers can obtain sensitive information via victim's browser history or log files...

PT-2026-83099

Name of the Vulnerable Software and Affected Versions gix-url versions prior to 0.37.1 gix-transport versions prior to 0.58.1 Description The gix-url crate employs a custom URL parser that fails to treat '?' or '' as terminators for the authority component, violating RFC 3986. This leads to a...

CVE-2026-37710

Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL function...

FreeBSD : PHP Composer -- Multiple vulnerabilities (db135cd1-a232-11f1-85ed-10ffe07f9334)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the db135cd1-a232-11f1-85ed-10ffe07f9334 advisory. Composer project reports: Validate package bin paths against path traversal using symlinks...

CVE-2026-37237

The vLLM library (up to and including version 0.17.0 ) is vulnerable to a Denial of Service (DoS) via memory exhaustion. The root cause lies in the AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image functions within multimodal/inputs.py. These functions utilize the aiohttp library to fetch use...

CVE-2026-37710

Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL function...

WebOb: Open redirect in Location header normalization via leading C0 control / space characters

Summary This is a third follow-up to CVE-2024-42353 / GHSA-mg3v-6m49-jhp3 and CVE-2026-44889 / GHSA-fh3h-vg37-cc95. WebOb makes the Location header absolute when it serves a redirect. To stop a relative or protocol-relative target from redirecting users off-host, it checks the value for a URI...