PT-2026-65766

Apache Traffic Server allows redirect-limit bypass when plugins reset the retry counter, enabling SSRF amplification. This issue affects Apache Traffic Server: from 8.0.0 through 8.1.9, from 9.0.0 through 9.2.14, from 10.0.0 through 10.1.3. Users are recommended to upgrade to version 9.2.15 or...

Linux Distros Unpatched Vulnerability : CVE-2026-58152

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Apache Traffic Server mishandles integers while decoding HPACK/XPACK headers, corrupting memory. This issue affects Apache Traffic Server: from 8.0.0 through...

CVE-2026-66299

Uncontrolled Resource Consumption vulnerability in Apache Tomcat's WebSocket chat example. This issue affects Apache Tomcat: from 11.0.0-M20 through 11.0.24, from 10.1.24 through 10.1.57, from 9.0.89 through 9.0.120. Users who have followed the security guidance to remove the examples web...

Information Exposure

Overview parse-server is a version of the Parse backend that can be deployed to any infrastructure that can run Node.js. Affected versions of this package are vulnerable to Information Exposure via the GraphQL error message handling process. An attacker can obtain the names of required custom inp...

Server-side Request Forgery (SSRF)

Overview phpoffice/phpspreadsheet is a Spreadsheet engine that Read, Create and Write Spreadsheet documents in PHP . Affected versions of this package are vulnerable to Server-side Request Forgery SSRF in the webService process. An attacker can access internal services and exfiltrate sensitive da...

Incorrect Authorization

Overview @n8n/n8n-nodes-langchain is a Affected versions of this package are vulnerable to Incorrect Authorization via the Execute Sub-workflow. An attacker can access unauthorized credentials by referencing credential IDs within inline workflow JSON, bypassing intended access controls. Note: Thi...

n8n: Expression sandbox escape via arrow-function bodies enabling command execution

Impact An authenticated user with permission to create or modify workflows could abuse crafted expressions using arrow functions to bypass the expression sandbox, triggering unintended system command execution on the host running n8n. Patches The issue has been fixed in n8n versions 2.31.5 and...

n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access

Impact Endpoints in /rest/dynamic-node-parameters/ lacked authorization scopes, making it reachable by any authenticated user with no workflow creation or execution required. By supplying an absolute URL in the routing configuration, a caller could override the node type's declared baseURL,...

GHSA-9W78-79Q7-R4FP n8n: Authenticated SSRF via Dynamic Node Parameters Endpoints Allows Internal Network Access

Impact Endpoints in /rest/dynamic-node-parameters/ lacked authorization scopes, making it reachable by any authenticated user with no workflow creation or execution required. By supplying an absolute URL in the routing configuration, a caller could override the node type's declared baseURL,...

K000162353: Apache Tomcat vulnerabilities CVE-2026-59083 and CVE-2026-59084

Security Advisory Description CVE-2026-59083 Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56,...

Medium: tomcat10

Issue Overview: Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS vulnerability in the number guess example for Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.22, from 10.1.0-M1 through 10.1.55, from 9.0.0.M1 through 9.0.118, from 8.5.0...

CVE-2026-59173

CVE-2026-59173 is an Uncontrolled Resource Consumption (DoS) vulnerability in Apache Traffic Server. Affected: versions 9.0.0–9.1.13 and 10.0.0–10.1.2. Root cause and impact: unresolved resource exhaustion potentially affecting service availability. Remediation: upgrade to 9.1.14 or 10.1.3, which...

SQL Injection

Overview johnpbloch/wordpress-core is a web software you can use to create a website or blog. Affected versions of this package are vulnerable to SQL Injection in the WPQuery::getposts method of class-wp-query.php, which applies integer casting to the authornotin query variable only when it is an...

CVE-2026-61863

A flaw was found in ImageMagick. When processing a Tagged Image File Format TIFF image, a small memory leak can occur if the TIFF encoder is unable to create a temporary file. This can lead to a gradual consumption of system memory, potentially impacting the availability of the application...

SUSE CVE-2026-59084

Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from...

Improper Encoding or Escaping of Output

Overview magento/community-edition is a modern cloud eCommerce platform. Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output via improper encoding or escaping of output. An attacker can execute arbitrary code in the context of the current user by crafting...

CVE-2026-59083

Improper Handling of URL Encoding Hex Encoding vulnerability in Apache Tomcat's rewrite valve allowed security constraint bypass for some configurations. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.0.M1 through 9.0.119, from 8.5.0...

CVE-2026-59084 Apache Tomcat: EncryptInterceptor requirements not clearly documented

Insufficient Technical Documentation vulnerability in Apache Tomcat since the requirements to securely configure the EncryptInterceptor were not clearly documented. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.23, from 10.1.0-M1 through 10.1.56, from 9.0.13 through 9.0.119, from...

CVE-2026-59084

CVE-2026-59084 affects Apache Tomcat across multiple branches (11.x, 10.x, 9.x, 8.x, 7.x) where EncryptInterceptor configuration requirements were not clearly documented, per NVD and related sources. Root cause: insufficient technical documentation for EncryptInterceptor configuration. Impact sta...

CVE-2026-59083

Apache Tomcat is affected by CVE-2026-59083 due to incorrect URL decoding in RewriteValve, enabling a possible security constraint bypass for certain configurations. Affected branches include 11.0.0-M1–11.0.23, 10.1.0-M1–10.1.56, 9.0.0.M1–9.0.119, and 8.5.0–8.5.100. Remediation is to upgrade to f...