CVE-2026-15006 Bit integrations <= 2.9.0 - Unauthenticated Arbitrary File Read via Optional CF7 File Field

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.0 via the processAttachment function. This makes it possible for unauthenticated attackers to read the...

EUVD-2026-51689

The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 2.9.0 via the processAttachment function. This makes it possible for unauthenticated attackers to read the...

EUVD-2026-36574

sanitize-html has incomplete URI scheme validation in that allows javascript: URIs through action, formaction, data, poster, and background attributes...

CVE-2026-53510 Savon::Model evaluates WSDL operation names as Ruby source

Savon is a Ruby SOAP client. From 0.9.8 until 2.17.2, Savon::Model .alloperations interpolates attacker-controlled WSDL operation names into Ruby source passed to moduleeval, allowing Ruby code execution in the application process. This issue is fixed in version 2.17.2...

CVE-2026-54737

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This iss...

CVE-2026-54737

@phun-ky/defaults-deep is a library like lodash defaultsDeep with array preservation and no lodash dependency. Prior to 2.0.5, defaultsDeep recursively merges user-supplied objects without filtering proto, constructor, and prototype, allowing properties to be written to Object.prototype. This iss...

CVE-2026-67607 LightFTP 2.3.1 Race Condition DoS via worker_thread_cleanup

LightFTP 2.3.1 contains a residual race condition vulnerability an incomplete fix for CVE-2024-11144 in the workerthreadcleanup function of ftpserv.c that allows remote unauthenticated attackers to destabilize or crash the daemon by triggering unsynchronized access to shared per-connection state...

CVE-2026-56671

The CVE-2026-56671 affects ComfyUI prior to 0.28.0. Root cause: get_model_preview in app/model_manager.py constructs a path using os.path.join(folder, filename) with an unrestricted {filename} capture, allowing path traversal via literals like ../, encoded traversal, absolute paths, or an unbound...

Cisco IOS Software IKEv2 Multiple Vulnerabilities (cisco-sa-asa-ftd-ios-dos-DOESHWHy)

According to its self-reported version, Cisco IOS is affected by multiple vulnerabilities. - A vulnerability in the IKEv2 feature of Cisco IOS Software, IOS XE Software, Secure Firewall ASA Software, and Secure FTD Software could allow an unauthenticated, remote attacker to cause the device to...

Cisco Adaptive Security Appliance (ASA) Software IKEv2 Multiple Vulnerabilities (cisco-sa-asa-ftd-ios-dos-DOESHWHy)

According to its self-reported version, Cisco ASA Software is affected by multiple vulnerabilities. - A vulnerability in the IKEv2 feature of Cisco IOS Software, IOS XE Software, Secure Firewall ASA Software, and Secure FTD Software could allow an unauthenticated, remote attacker to cause the...

CVE-2026-61536

Banks generates meaningful LLM prompts using a simple template language. In versions prior to 2.4.3, banks parses Tool JSON objects from the rendered body of % completion % blocks and later resolves their importpath field through importlib.importmodule... + getattr... to obtain the callable that...

EUVD-2026-50468

Flyto2 Core: LLM/API keys leak to an attacker-controlled baseurl...

CVE-2026-64785

A flaw was found in SwiftNIO HTTP/2. This vulnerability allows a remote attacker to perform HTTP request smuggling or response splitting. The issue stems from insufficient validation of incoming HTTP/2 HEADERS frames, which are parts of an HTTP/2 request. This allows special control characters,...

CVE-2026-16969 DFIR-IRIS Stored XSS in Assets

The IRIS web application in version 2.4.26 and possibly others is vulnerable to stored cross-site scripting XSS in the assets function...

CLEANSTART-2026-TW92291 Security fixes in dex 2.44.0-r1

Package dex version 2.44.0-r1 fixes 2 vulnerabilities: ghsa-78h2-9frx-2jm8, CVE-2026-34986...

CLEANSTART-2026-KZ64972 Security fixes in openbao-fips 2.5.0-r1

Package openbao-fips version 2.5.0-r1 fixes 3 vulnerabilities: CVE-2026-24051, CVE-2026-26958, CVE-2026-1229...

CLEANSTART-2026-QR90423 Security fixes in tempo-fips 2.9.1-r1

Package tempo-fips version 2.9.1-r1 fixes 2 vulnerabilities: CVE-2026-34986, CVE-2026-32285...

CLEANSTART-2026-BC05591 Security fixes in k8s-sidecar 2.4.0-r0

Package k8s-sidecar version 2.4.0-r0 fixes 10 vulnerabilities: CVE-2026-44431, CVE-2026-44432, ghsa-mf9v-mfxr-j63j, ghsa-qccp-gfcp-xxvc, CVE-2026-3219...

CLEANSTART-2026-QT14649 Security fixes in vault 2.0.0-r1

Package vault version 2.0.0-r1 fixes 35 vulnerabilities: CVE-2026-39821, CVE-2026-39830, CVE-2026-39831, CVE-2026-39832, CVE-2026-39833...

CLEANSTART-2026-EP15881 Security fixes in cert-manager-webhook-pdns-fips 2.3.0-r0

Package cert-manager-webhook-pdns-fips version 2.3.0-r0 fixes 17 vulnerabilities: CVE-2022-1996, CVE-2023-45142, CVE-2023-25151, CVE-2022-21698, CVE-2022-30636...