PT-2026-105081

Discourse is an open-source discussion platform. Prior to 2026.1.8, 2026.6.3, 2026.7.2, and 2026.8.0, sites using wildcard patterns in the allowed iframes setting could accept a crafted iframe URL whose allowlisted suffix appeared after a URL authority separator. The wildcard origin check matched...

MediaWiki CommonsMetadata 1.46 License URL Cross Site Scripting

MediaWiki CommonsMetadata extension versions 1.43, 1.45, and 1.46 contain a cross site scripting vulnerability through insufficient validation of license URLs. The supplied proof of concept checks local API metadata for an executable javascript: URL...

CVE-2026-103254: Improper Limitation of a Pathname to a Restricted Directory

n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a path traversal vulnerability in signed resume URL generation for Send-and-Wait approvals. Attackers with workflow creation permissions can mint valid approval URLs for gates in projects they cannot...

CVE-2026-103542: Server-Side Request Forgery (SSRF)

A flaw has been found in formtools.org Form Tools up to 3.1.1. Impacted is the function smartfill of the file /global/code/actions.php of the component AJAX Endpoint. This manipulation of the argument url causes server-side request forgery. The attack can be initiated remotely. The exploit has be...

PT-2026-103693

Name of the Vulnerable Software and Affected Versions Featured Image from URL FIFU WordPress plugin versions prior to 6.0.8 Featured Image from URL FIFU Premium WordPress plugin versions prior to 8.2.8 Description Cross-Site Request Forgery CSRF occurs because the software fails to correctly...

PT-2026-103787

Name of the Vulnerable Software and Affected Versions n8n versions prior to 1.123.80 n8n versions 2.0.0 through 2.39.5 n8n versions 2.40.0 Description A path traversal issue exists in the signed resume URL generation for Send-and-Wait approvals. Users with workflow creation permissions can forge...

PT-2026-103808

Name of the Vulnerable Software and Affected Versions Ghost versions prior to 6.20.0 Description An issue exists where unauthenticated attackers can read theme templates and metadata. This is possible through a file extension filtering bypass, where attackers utilize URL encoding to circumvent...

PT-2026-103661

The Newsletter – Send awesome emails from WordPress plugin for WordPress is vulnerable to Insufficiently Protected Credentials in all versions up to, and including, 9.3.9 The plugin's public click-tracking REST route /tnp/l/ is registered with permission callback = ' return true' and, upon...

PT-2026-103718

Name of the Vulnerable Software and Affected Versions Social Media Share Buttons & Social Sharing Icons versions prior to 3.0.2 Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Reflected Cross-Site Scripting XSS, a technique where maliciou...

PT-2026-103834

Name of the Vulnerable Software and Affected Versions Apache APISIX versions 2.14.1 through 3.18.0 Description An issue exists where the use of non-canonical URL paths for authorization decisions allows a crafted encoded path to reach an upstream endpoint. In configurations where a permissive rou...

PT-2026-105865

Summary Open WebUI fetches user-supplied URLs on the server for RAG URL ingestion and web search, and screens the resolved addresses so internal destinations cannot be reached. That screen decided whether a destination was external by asking Python's standard library whether the address is global...

PT-2026-105838

Summary The SSRF protection for header-based authentication uses a validate-then-use pattern vulnerable to DNS rebinding. validate url for ssrf resolves the hostname via DNS and checks that the resolved IP is globally routable. However, the actual HTTP request happens later, during which the DNS...

PT-2026-105839

Summary The UserTokenMiddleware extracts URLs from X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url HTTP headers and passes them directly to API client constructors without any SSRF validation. Affected Package - Ecosystem: PyPI - Package: mcp-atlassian - Affected versions: all versions before...

CVE-2026-94269: Use of Non-Canonical URL Paths for Authorization Decisions

Use of Non-Canonical URL paths for authorization decisions vulnerability in Apache APISIX. In some configurations where a permissive route overlaps a protected one, a crafted encoded path can reach an upstream endpoint that the matched route's policies were never meant to cover. A request that...

PT-2026-105853

Summary The mcp-atlassian server exposes an MCP tool confluence upload attachment and the Jira attachment variant that accepts an arbitrary server-side file path and opens it for upload without any path validation. When the server is deployed in HTTP transport mode streamable-http or sse, a remot...

PT-2026-105848

Environment - Project: sooperset/mcp-atlassian - Affected function: validate url for ssrf - Affected path: header-based Jira/Confluence URL authentication flow - Tested endpoint: POST /mcp - Tested version: 2.14.5 Description The SSRF protection in validate url for ssrf can be bypassed with a URL...

AlmaLinux 9.2 [TuxCare] Security Update: vim-X11 / vim-common / vim-enhanced / vim-filesystem / vim-minimal Multiple Vulnerabilities (ALMALINUX9.2:CLSA-2026:1780713496)

The AlmaLinux 9.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare ALMALINUX9.2:CLSA-2026:1780713496 advisory. - Vim is an open source, command line text editor. Prior to 9.2.0357, A command injection vulnerability exists in Vim's tag file...

Rocky Linux 10.2 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (crlsa-2026_19022)

The Rocky Linux 10.2 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202619022 advisory. crypto/x509: Incorrect enforcement of email constraints in crypto/x509 CVE-2026-27137 net/url: Incorrect parsing of IPv6 host literals in net/url...

Rocky Linux 9 [CIQ] Security Update: go-toolset / golang / golang-bin / golang-docs / golang-misc / etc Multiple Vulnerabilities (crlsa-2026_19181)

The Rocky Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202619181 advisory. crypto/x509: Incorrect enforcement of email constraints in crypto/x509 CVE-2026-27137 net/url: Incorrect parsing of IPv6 host literals in net/url...

Rocky Linux 8 [CIQ] Security Update: thunderbird / thunderbird-debuginfo / thunderbird-debugsource Multiple Vulnerabilities (crlsa-2023_7500)

The Rocky Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-20237500 advisory. Mozilla: Out-of-bound memory access in WebGL2 blitFramebuffer CVE-2023-6204 Mozilla: Use-after-free in MessagePort::Entangled CVE-2023-6205 Mozilla:...