OESA-2026-2729 mercurial security update

Mercurial is a free, distributed source control management tool. It efficiently handles projects of any size and offers an easy and intuitive interface. Security Fixes: A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects...

OESA-2026-2731 mercurial security update

Mercurial is a free, distributed source control management tool. It efficiently handles projects of any size and offers an easy and intuitive interface. Security Fixes: A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects...

OESA-2026-2730 mercurial security update

Mercurial is a free, distributed source control management tool. It efficiently handles projects of any size and offers an easy and intuitive interface. Security Fixes: A vulnerability was found in Mercurial SCM 4.5.3/71.19.145.211. It has been declared as problematic. This vulnerability affects...

CVE-2026-1840: Missing Authentication for Critical Function

The Aclara Metrum Cellular Web Interface is vulnerable to unauthorized access due to the absence of authentication controls on critical system functions. This weakness exposes essential configuration settings, allowing attackers to alter operational parameters and trigger system restarts without...

The vulnerability in the web interface of the operating system PAN-OS for network interfaces of the PA-Series, VM-Series, and virtual devices of the M-Series series allows a perpetrator to execute arbitrary code.

The vulnerability of the PAN-OS operating system’s web interface for PA-Series, VM-Series, and M-Series virtual devices is related to the lack of measures taken to protect the website structure. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

EUVD-2026-38535

Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, POST /api/v1/calendars/events/eventid/update validates that the caller has write access to the calendar the event currently belongs to, but does not validate the destination calendar...

CVE-2026-54019

Open WebUI CVE-2026-54019 describes an ACL bypass in Milvus multitenancy mode. Before version 0.9.6, collection-level ACL checks exist but can be bypassed when an attacker supplies user-controlled, unknown collection names, which Milvus treats as a resource_id and interpolates into an unsafe expr...

Hubbell Aclara Metrum Cellular Web Interface

ADVISORY SUMMARY Successful exploitation of this vulnerability could allow attackers to manipulate critical device settings and repeatedly disrupt operations, potentially causing a loss of communications to the device. 2. RECOMMENDED PRACTICES CISA recommends users take defensive measures to...

PT-2026-51645

Name of the Vulnerable Software and Affected Versions Snipe-IT versions prior to 8.4.1 Description An authenticated user with generic asset edit permissions can delete files attached to assets regardless of ownership or company assignment. This is caused by an Insecure Direct Object Reference IDO...

VulnCheck KEV: CVE-2025-67038

Lantronix EDS5000 contains a code injection vulnerability that could allow attackers to inject arbitrary OS commands into the username parameter. Injected commands are executed with root privileges...

The vulnerability in the web interface for managing microprogrammed software routers UTT HiPER 1250GW allows a hacker to trigger a service failure.

The vulnerability of the web-based management interface for UTT HiPER 1250GW microprogramming software is related to buffer overflow in the stack when processing the Profile parameter. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability in the web interface for managing micro-program software-based network devices UTT 1200GW allows a perpetrator to cause a service failure.

The vulnerability of the web-based interface for managing microprogrammed network devices UTT 1200GW is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service failures...

The vulnerability in the web interface for managing microprogrammed software routers UTT HiPER 1250GW allows a hacker to trigger a service failure.

The vulnerability of the web-based management interface for UTT HiPER 1250GW microprogramming software is related to buffer overflow in the stack when processing the Profile parameter. Exploiting this vulnerability can allow an attacker to cause a service failure...

The vulnerability in the web interface for managing microprogrammed network devices UTT 1200GW allows a perpetrator to cause a service failure.

The vulnerability in the web interface for managing microprogrammed network devices UTT 1200GW is related to the data being written beyond the buffer boundaries in memory when processing the sysAdmUser/sysAdmPass parameter. Exploitation of this vulnerability could allow a malicious actor to cause...

EUVD-2026-0815

ComfyUI-Manager has an Unprotected Alternate Channel CWE-420...

GHSA-95PQ-HR8P-F5G7 ComfyUI-Manager has an Unprotected Alternate Channel (CWE-420)

Impact An Unprotected Alternate Channel CWE-420 vulnerability was discovered in ComfyUI-Manager versions prior to 3.38. Vulnerability Details In affected versions, ComfyUI-Manager stored its configuration in the user/default/ComfyUI-Manager/ directory, which was accessible via ComfyUI's web APIs...

CVE-2026-8059 Multiple Vulnerabilities in IBM Datacap

IBM Datacap 9.1.7, 9.1.8, and 9.1.9 and IBM Datacap Navigator 9.1.7, 9.1.8, and 9.1.9 is vulnerable to cross-site scripting. This vulnerability allows an unauthenticated attacker to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to...

CVE-2025-33128 IBM Engineering Lifecycle Management - Engineering Workflow Management is impacted by vulnerabilities HTML / XSS Injection observed

IBM Engineering Workflow Management 7.0.3 through 7.0.3 Interim Fix 020, and 7.1 through 7.1 Interim Fix 007 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially...

Incorrect Authorization

Overview org.apache.nifi:nifi-web-api is a system to process and distribute data. Affected versions of this package are vulnerable to Incorrect Authorization while configuring verification requests. An attacker can override existing configuration properties by submitting alternative settings...

PT-2026-51428

Name of the Vulnerable Software and Affected Versions Gogs versions prior to 0.14.3 Description A malicious user with permissions to create files in a repository or wiki page can trigger a denial of service. This occurs when pages containing file listings return an HTTP 500 error, rendering the w...