CVE-2026-12985: URL Redirection to Untrusted Site

Mattermost versions 11.9.x = 11.9.0, 11.8.x = 11.8.4, 11.7.x = 11.7.7 Mattermost failed to validate Dynamic Client Registration redirect URIs by URL component matching glob patterns against the raw URI string instead which allows a remote unauthenticated attacker to register an OAuth client with ...

PT-2026-91442

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. From 0.17.0 until 0.22.0, validate url for ssrf resolves the attacker-controlled X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url header host once at middleware time, but the outbound request is...

CVE-2026-73497: Server-Side Request Forgery (SSRF)

MCP Atlassian is a Model Context Protocol MCP server for Atlassian products Confluence and Jira. From 0.17.0 until 0.22.0, validateurlforssrf resolves the attacker-controlled X-Atlassian-Jira-Url and X-Atlassian-Confluence-Url header host once at middleware time, but the outbound request is built...

PT-2026-91102

Joomla Extension - regularlabs.com - Privileged stored XSS via executable URL schemes in Modals extension for Joomla 17.0.0 - Modals treats a destination using an executable browser URL scheme as an ordinary modal URL. The value can reach both the generated link and the iframe-loading path...

MiracleLinux 9 : python-lxml-4.6.5-3.el9_8.1 (AXSA:2026-1823:01)

The remote MiracleLinux 9 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1823:01 advisory. lxml: lxml-html-clean: lxml: URL bypass vulnerability in Cleaner via missing xlink:href CVE-2026-49825 Tenable has extracted the preceding description block...

RHEL 9 : python-lxml (RHSA-2026:67325)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:67325 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

CVE-2026-47256: Improper Limitation of a Pathname to a Restricted Directory

OpenTelemetry, also known as OTel, is a vendor-neutral open source Observability framework for instrumenting, generating, collecting, and exporting telemetry data such as traces, metrics, and logs. Prior to 0.154.0, the Sentry exporter reads the remote OTLP sender-controlled service.name resource...

RHEL 9 : python-lxml (RHSA-2026:67324)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:67324 advisory. Python is an interpreted, interactive, object-oriented programming language, which includes modules, classes, exceptions, very high level dynamic da...

AlmaLinux 8 : git-lfs (ALSA-2026:67161)

The remote AlmaLinux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the ALSA-2026:67161 advisory. encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal CVE-2026-33818 net/url: golang: golang net/url: Denial of...

CVE-2026-90607: Buffer Copy without Checking Size of Input

A vulnerability was detected in Totolink A3002MU Hh-B20211125.1046. Impacted is the function formNewSchedule of the file /boafrm/formNewSchedule of the component boa. The manipulation of the argument submit-url results in buffer overflow. The attack may be performed from remote. The exploit is no...

CVE-2026-90603

A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/upload-binary of the component S3 Upload. Such manipulation of the argument x-proxy-target-url leads to unrestricted upload. The attack may be...

CVE-2026-90603 Anil-matcha Open-Generative-AI S3 Upload upload-binary unrestricted upload

A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/upload-binary of the component S3 Upload. Such manipulation of the argument x-proxy-target-url leads to unrestricted upload. The attack may be...

CVE-2026-90603

CVE-2026-90603 affects Anil-matcha Open-Generative-AI versions up to 1.0.11/2.0.0 . The vulnerability resides in the S3 Upload component, specifically the /api/upload-binary endpoint, where manipulation of the x-proxy-target-url argument enables an unrestricted upload . An unauthenticated remote ...

CVE-2026-90603 Anil-matcha Open-Generative-AI S3 Upload upload-binary unrestricted upload

A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/upload-binary of the component S3 Upload. Such manipulation of the argument x-proxy-target-url leads to unrestricted upload. The attack may be...

CVE-2026-90603 Anil-matcha Open-Generative-AI S3 Upload upload-binary unrestricted upload

A vulnerability was identified in Anil-matcha Open-Generative-AI up to 1.0.11/2.0.0. Affected by this issue is some unknown functionality of the file /api/upload-binary of the component S3 Upload. Such manipulation of the argument x-proxy-target-url leads to unrestricted upload. The attack may be...

CVE-2026-90581

A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2. This issue affects the function MainController.autoUpdate of the file /adminPage/main/autoUpdate. This manipulation of the argument url causes code injection. Remote exploitation of the attack is possible. The exploit has been...

CVE-2026-89050 Quads Ads Manager for Google AdSense < 3.0.5 - Subscriber+ Ad-Selling Payment Bypass via Unverified Success Return URL

The Quads Ads Manager for Google AdSense WordPress plugin before 3.0.5 does not verify payment completion with the configured payment gateway before marking an ad-selling order as paid, allowing users who can place an order to obtain a paid ad placement without payment...

CVE-2026-89050 Quads Ads Manager for Google AdSense < 3.0.5 - Subscriber+ Ad-Selling Payment Bypass via Unverified Success Return URL

The Quads Ads Manager for Google AdSense WordPress plugin before 3.0.5 does not verify payment completion with the configured payment gateway before marking an ad-selling order as paid, allowing users who can place an order to obtain a paid ad placement without payment...

CVE-2026-89050

The Quads Ads Manager for Google AdSense WordPress plugin, in versions before 3.0.5 , fails to verify payment completion with the configured payment gateway before marking an ad-selling order as paid. This allows authenticated users with the Subscriber+ role who can place an order to obtain a pai...

CVE-2026-90581 cym1102 nginxWebUI autoUpdate MainController.autoUpdate code injection

A vulnerability was determined in cym1102 nginxWebUI up to 4.4.2. This issue affects the function MainController.autoUpdate of the file /adminPage/main/autoUpdate. This manipulation of the argument url causes code injection. Remote exploitation of the attack is possible. The exploit has been...