CVE-2026-23931

The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of confidentiality...

CVE-2026-75828: Improper Neutralization of Input During Web Page Generation

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss function where unpaired quotes in unquoted attribute values bypass event-handler detection. Authenticated editors can inject event handlers like onerror= that pass validation and execute in visitor browsers...

CVE-2026-23931: Observable Discrepancy

The frontend validatate.api.exists action can be exploited by authenticated users to extract plaintext user macro values leading to potential loss of confidentiality...

Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

Overview openssl-encrypt is an A package for secure file encryption and decryption based on modern ciphers using heavy-compute-load chaining of hashing and KDF to generate strong encryption password based on users provided password to ensure secure encryption of files Affected versions of this...

Glances: Incomplete fix of CVE-2026-32608: action-template sanitizer is bypassed by nested stat values (process 'cmdline') → OS command injection

Summary CVE-2026-32608 "Command Injection via Process Names in Action Command Templates" was fixed commit 5680a5d by adding sanitizemustachedict, which replaces the shell operators &&, |, , with spaces in the values rendered into action command templates. The sanitizer only processes top-level...

EUVD-2026-60303

Glances is an open-source system cross-platform monitoring tool. From 4.5.2 until 4.5.6, sanitizemustachedict in glances/actions.py skips nested list and dictionary strings such as process cmdline values, allowing pipe characters to survive chevron.render and be executed by securepopen through...

EUVD-2026-60302

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.6, asdictsecure in glances/config.py checks only option names and exposes publicusername and credentials embedded in publicapi values through unauthenticated GET /api/4/config and GET /api/4/config/ip requests. This iss...

CVE-2026-8723

A flaw was found in the qs library. When the qs.stringify function processes arrays containing null or undefined elements, and is configured with both arrayFormat: 'comma' and encodeValuesOnly: true, it can trigger a TypeError. This error causes the application to crash or return a 500 error,...

PYSEC-2026-3745

opensslencrypt before 1.4.0 imports Python's non-cryptographic 'random' module Mersenne Twister PRNG at line 15 of opensslencrypt/modules/pqc.py. No direct calls to random. were present in the code, so no cryptographic operation is currently affected; however, the import creates a hazard that...

CVE-2026-74887 openssl_encrypt before 1.4.0 Insecure Random Import in PQC Module

opensslencrypt before 1.4.0 imports Python's non-cryptographic 'random' module Mersenne Twister PRNG at line 15 of opensslencrypt/modules/pqc.py. No direct calls to random. were present in the code, so no cryptographic operation is currently affected; however, the import creates a hazard that...

PT-2026-76623

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.0 Description The software imports Python's non-cryptographic random module, which uses a Mersenne Twister Pseudo-Random Number Generator PRNG, within the openssl encrypt/modules/pqc.py file. While no...

CVE-2024-58375

OpenTofu versions 1.8.0 through 1.8.2 do not properly restrict sensitive variables and locals when users have opted into static evaluation of module sources, versions, and backend configurations. As a result, values marked as sensitive may be exposed through these configuration elements instead o...

SUSE CVE-2020-27223

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 inclusive, 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of "quality" i.e. q parameters, the server may enter a denial of service DoS state due to high CPU usage processing those quality...

CVE-2026-19613: Exposure of Sensitive Information to an Unauthorized Actor

The ECS WordPress plugin before 4.3.10 does not perform ownership or post-status checks when one of its dynamic repeater data sources reads custom field values from a user-supplied post identifier, allowing users with a contributor-level account or above to read custom field values and post...

CVE-2026-19896: Use of Insufficiently Random Values

A flaw has been found in mangroup dtale up to 3.22.0. This vulnerability affects the function buildsecretkey of the file dtale/app.py of the component Flask Session Cookie. This manipulation causes insufficiently random values. Remote exploitation of the attack is possible. The attack's complexit...

CVE-2026-16146: Improper Neutralization of Special Elements used in an SQL Command

The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms plugin for WordPress is vulnerable to generic SQL Injection via Pattern JSON Keys/Values in all versions up to, and including, 5.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation...

CVE-2026-74294: Undefined Security Weakness

In the Linux kernel, the following vulnerability has been resolved: ASoC: meson: aiu: Validate written enum values The AIU HDMI and internal codec mux put callbacks use the written enum value with sndsocenumitemtoval before checking whether the value is valid for the enumeration. Reject...

CVE-2026-19628

A command injection vulnerability exists in Tenable Security Center. An authenticated administrator could modify application configuration values to achieve arbitrary command execution on the underlying operating system when specific backend operations are triggered...

PT-2026-72056

Name of the Vulnerable Software and Affected Versions Tenable Security Center affected versions not specified Description A command injection flaw allows an authenticated administrator to execute arbitrary commands on the underlying operating system. This occurs when the administrator modifies...

CVE-2026-72672 Incorrect Authorization in Kibana Leading to Disclosure of Elastic Defend Endpoint Event Data

The Elastic Security capability that suggests existing field values while a user authors endpoint policy artifacts queries Elastic Defend event data with Kibana's internal Elasticsearch account instead of the account of the requesting user. Only Kibana feature privileges are verified, and the...