RHEL 9 : NetworkManager (RHSA-2026:61244)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61244 advisory. NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when...

RHEL 8 : NetworkManager (RHSA-2026:61572)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:61572 advisory. NetworkManager is a system network service that manages network devices and connections, attempting to keep active network connectivity when...

MiracleLinux 9 : NetworkManager-1.54.3-5.el9_8.ML.1 (AXSA:2026-1704:07)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1704:07 advisory. NetworkManager: NetworkManager: Local privilege escalation via malformed MUD URLs in dhclient backend CVE-2026-10805 Tenable has extracted the preceding...

PT-2026-83447

Name of the Vulnerable Software and Affected Versions Rodauth versions prior to 2.47.0 Description Insufficient validation of protocol-relative return-to paths occurs within the confirm password, login return to requested location, and two factor auth return to requested location features. This...

CVE-2026-82467: URL Redirection to Untrusted Site

Rodauth before 2.47.0 fails to validate protocol-relative return-to paths in confirmpassword, loginreturntorequestedlocation, and twofactorauthreturntorequestedlocation features. Attackers can craft paths with leading double slashes that browsers resolve as protocol-relative URLs, redirecting...

AZL-98340 CVE-2026-54330 affecting package ceph for versions less than 18.2.2-13

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the Ceph Object Gateway RGW SigV4 handler does not reject requests that carry x-amz- headers absent from the signed header set, allowing anyone holding a presigne...

CVE-2026-53580 Trilium arbitrary file read and denial of service via file:// URLs in the automatic image-download feature

Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a note's img tags and reads the referenced local file with no path validation, allowing any authenticated user to disclose arbitrary files...

CVE-2026-53580

Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a note's img tags and reads the referenced local file with no path validation, allowing any authenticated user to disclose arbitrary files...

CVE-2026-53580

Trilium is an open-source hierarchical note-taking application affected in versions prior to 0.104.0 . The automatic image-download feature accepts file:// URLs in tags within text notes and performs a filesystem read with no path validation . Because the HTML sanitizer allows the file scheme, a...

CVE-2026-81691 openssl_encrypt before 1.4.9 Credential Leakage via Unvalidated Server URLs

opensslencrypt versions before 1.4.9 fail to validate server URLs in login and registerwithemail functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including clientid, passwords, and JWTs to achieve full keyserve...

CVE-2026-81691 openssl_encrypt before 1.4.9 Credential Leakage via Unvalidated Server URLs

opensslencrypt versions before 1.4.9 fail to validate server URLs in login and registerwithemail functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including clientid, passwords, and JWTs to achieve full keyserve...

CVE-2026-81691 openssl_encrypt before 1.4.9 Credential Leakage via Unvalidated Server URLs

opensslencrypt versions before 1.4.9 fail to validate server URLs in login and registerwithemail functions, accepting unencrypted http:// URLs and unconfigured hosts. Attackers on the network path can intercept cleartext credentials including clientid, passwords, and JWTs to achieve full keyserve...

CVE-2026-81691

openssl_encrypt versions before 1.4.9 fail to validate server URLs in the login and register_with_email functions, accepting unencrypted http:// URLs and unconfigured hosts. This allows an attacker on the network path to intercept cleartext credentials —including client_id, passwords, and JWTs—re...

SUSE-SU-2026:3846-1 Security update for python36-pip

This update for python36-pip fixes the following issue: - CVE-2026-13346: incorrect handling of doubly-encoded package URLs from malicious indexes allows files to be installed to arbitrary locations on disk bsc1273090...

CVE-2026-53580: External Control of File Name or Path

Trilium is an open-source hierarchical note-taking application. In versions prior to 0.104.0, the automatic image-download feature accepts file:// URLs in a note's img tags and reads the referenced local file with no path validation, allowing any authenticated user to disclose arbitrary files...

Exploit for CVE-2026-75898

CVE-2026-75898 — RAGFlow Invoke component SSRF Server-Side Re...

Security Bulletin: IBM Integrated Analytics System (IIAS) is affected by multiple path traversal vulnerabilities due to pip

Summary pip is used by IBM Integrated Analytics System as the standard Python package installer. Multiple vulnerabilities affect pip. CVE-2026-8643 involves improper sanitization of resolved absolute paths for consolescripts and guiscripts entry points, where pip treats them as paths instead of...

VulnCheck KEV: CVE-2023-49105

An issue was discovered in ownCloud owncloud/core before 10.13.1. An attacker can access, modify, or delete any file without authentication if the username of a victim is known, and the victim has no signing-key configured. This occurs because pre-signed URLs can be accepted even when no...

tirith v0.4.0

tirith Your browser would catch this. Your terminal won't. Website | Docs | SKILL.md | Changelog Independent open-source project, with hosting supported by the Vercel Open Source Program Spring 2026 Cohort. Can you spot the difference? root@kitploit: curl -sSL https://install.example-cli.dev | ba...

GO-2026-6268 Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs in github.com/fleetdm/fleet

Fleet: Unauthenticated download of in-house iOS app binaries via predictable URLs in github.com/fleetdm/fleet...