CVE-2026-73240

Specifically crafted inputs may lead to git argument injection in Apache Allura. This issue affects Apache Allura: before 1.19.1. Users are recommended to upgrade to version 1.19.1, which fixes the issue...

CVE-2026-70467

A server-side request forgery ssrf vulnerability in Fortinet FortiSIEM 7.5.0, FortiSIEM 7.4.0 through 7.4.2, FortiSIEM 7.3.0 through 7.3.5, FortiSIEM 7.2 all versions, FortiSIEM 7.1 all versions, FortiSIEM 7.0 all versions, FortiSIEM 6.7 all versions, FortiSIEM 6.6 all versions, FortiSIEM 6.5 all...

CVE-2026-70467

Fortinet FortiSIEM is affected by a server-side request forgery (SSRF) vulnerability across multiple versions: 7.5.0; 7.4.x (7.4.0–7.4.2); 7.3.x (7.3.0–7.3.5); and all releases of 7.2, 7.1, 7.0, 6.7, 6.6, and 6.5. The issue may allow an attacker to execute unauthorized code or commands via an att...

GitLab 19.0 < 19.0.6 / 19.1 < 19.1.4 / 19.2 < 19.2.2 (CVE-2026-15423)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab CE/EE affecting all versions from 19.0 before 19.0.6, 19... CVE-2026-15423 Note that Nessus has not tested for this issue but has instead relied only on the...

PT-2026-71294

IBM Security Verify Access 10.0 through 10.0.9.2 and IBM Verify Identity Access 11.0 through 11.0.3 and IBM Verify Identity Access Container 11.0 through 11.0.3 is vulnerable to a denial of service attack...

CVE-2026-69223

CVE-2026-69223 affects Apache Allura prior to 1.19.1, where the webhooks are vulnerable to Server-Side Request Forgery (SSRF). The issue is rooted in the webhook handling in Allura, with the impact described as high confidentiality and integrity risk but no availability impact, and a network-expl...

EUVD-2026-56113

A vulnerability has been identified in Solid Edge SE2025 All versions V225.0 Update 15, Solid Edge SE2026 All versions V226.0 Update 7. The affected applications contain a use-after-free vulnerability that could be triggered while parsing specially crafted DFT files. This could allow an attacker ...

CVE-2026-15060

CVE-2026-15060 : The vulnerability affects systemd-machined on desktop systems running version ≥ v259 (or v258 with a local policy that permits the polkit action register-machine). An unprivileged user in a desktop graphical session can kill arbitrary processes, including privileged ones. Affecte...

CVE-2026-64941

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in phoenixframework phoenixliveview allows an attacker to send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR. redirect/2 validates :to through the private validatelocalurl!/...

CVE-2026-64941 Open redirect in Phoenix.LiveView.validate_local_url!/2 via ASCII tab, LF and CR

URL Redirection to Untrusted Site 'Open Redirect' vulnerability in phoenixframework phoenixliveview allows an attacker to send a victim's browser to an origin of the attacker's choosing via a :to value containing ASCII tab, LF or CR. redirect/2 validates :to through the private validatelocalurl!/...

PYSEC-2026-3629 Keras: HDF5 virtual datasets can disclose local files

Keras versions up to and including 3.13.2 are vulnerable to an arbitrary HDF5 file read due to an incomplete fix for CVE-2026-1669. The vulnerability resides in the H5IOStore.verifydataset and fileeditor.py methods, which fail to check the dataset.isvirtual property of HDF5 datasets. This allows ...

EUVD-2026-55252

Privilege Escalation via URL Parameter is reported in Apache Ranger versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-65942 Apache Ranger: Clients accept TLS certificates issued for other hostnames

TLS hostname verification issue in Apache Ranger Client Code in versions = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

Metabase-Exploit

Metabase SQL Injection Zero-Day Exploit GHSA-vwf4-m7j8-wcjf...

CVE-2026-18786

CVE-2026-18786 affects the CheckView WordPress plugin (versions before 2.3.2). The underlying issue is that the REST API authentication filter is not restricted to the plugin’s own routes and discards the authentication error for any request whose URI contains a plugin-specific string. This allow...

CVE-2026-12480 affecting package keras for versions less than 3.3.3-8

CVE-2026-12480 affecting package keras for versions less than 3.3.3-8. A patched version of the package is available...

CVE-2026-52880 Klever-Go: REST API slow-header connection exhaustion via Gin Engine.Run

Klever-Go is the Go implementation of the Klever blockchain protocol. Versions from 1.7.14 through 1.7.17 are vulnerable to a remotely triggerable denial of service. Both REST APIs are started with the Gin Engine.Run convenience method, which serves requests through Go's default HTTP server with ...

CVE-2026-52879 Klever-Go: Unbounded goroutine spawn on direct-message ingress enables peer-driven DoS

Klever-Go is the Go implementation of the Klever blockchain protocol. In versions 1.7.14 through 1.7.17, the direct-message ingress handler spawns a new goroutine for every incoming direct message before the processor-level antiflood layer makes any admission decision, with no semaphore, throttle...

CVE-2026-52878 Klever-Go: Unauthenticated nil-pointer DoS in P2P transaction validation can halt the chain

Klever-Go is the Go implementation of the Klever blockchain protocol. Versions 1.7.14 through 1.7.17 are vulnerable to a nil-pointer panic triggered by a protobuf Transaction whose embedded RawData sub-message is omitted. This omission causes RawData to decode to nil. Every transaction gossiped o...

EUVD-2026-54717

lakeFS is an open-source tool that transforms object storage into a Git-like repositories. Prior to version 1.81.1 of the open source edition and 1.84.0 of the enterprise edition, lakeFS Web UI renders markdown files from repository objects without sanitizing the resulting HTML. A user with write...