CVE-2026-77522 MaxKB: Authenticated full-read SSRF via the knowledge web-document import/sync crawler (Fork.fork requests.get, no internal-IP guard, non-blind)

MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the knowledge web-document import and synchronization crawler passes an authenticated workspace user's URL to Fork.fork, which calls requests.get with verify=False and without restricting schemes, loopback,...

CVE-2026-77522

MaxKB (open-source enterprise AI assistant by 1Panel-dev) versions 2.10.3-lts and earlier are affected by an authenticated full-read SSRF in the knowledge web-document import/sync crawler. The underlying cause is that Fork.fork invokes requests.get with verify=False and no restrictions on schemes...

firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Audio/Video: Web Codecs component...

CVE-2026-45381 Tautulli: Reflected XSS in `/search` endpoint

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the /search endpoint inserts its user-controlled query parameter into a JavaScript string in data/interfaces/default/search.html using manual escaping that handles quotes and slashes but not backslashe...

EUVD-2026-84069

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the newsletter cron field stored in the newsletters table is inserted by data/interfaces/default/newsletterconfig.html into a JavaScript string without safe JSON encoding. An administrator or caller wi...

CVE-2026-91166 Warpgate: Web SSH stores a jump host's key against the target's address, so it validates as the target

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. From 0.25.0 until 0.27.6, the browser SSH path in warpgate-web-ssh/src/manager.rs handles RCEvent::HostKeyUnknown without the presenting hop identity and instead passes sshoptions.host and sshoptions.port for the final target...

CVE-2026-91166

Warpgate is an open-source SSH, HTTPS, and MySQL bastion host for Linux. In versions 0.25.0 through 0.27.6 , the browser SSH path mishandles RCEvent::HostKeyUnknown by passing the final target's host and port to KnownHosts::trust instead of the presenting hop's identity. In Prompt and AutoAccept ...

firefox: thunderbird: Use-after-free in the Audio/Video: Web Codecs component

A flaw was found in Firefox and Thunderbird. The Mozilla Foundation's Security Advisory describes the following issue: Use-after-free in the Audio/Video: Web Codecs component...

Malicious code in @woodpecker-web-shared/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f5f21bcc5464689c5b7c70819eeca4ea481f76b5f7dac0358cfe2d967da235f On npm install, the package's postinstall hook runs node index.js, which collects installer host identifiers os.hostname, os.userInfo.username,...

MAL-2026-16354 Malicious code in @woodpecker-web-shared/components (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5f5f21bcc5464689c5b7c70819eeca4ea481f76b5f7dac0358cfe2d967da235f On npm install, the package's postinstall hook runs node index.js, which collects installer host identifiers os.hostname, os.userInfo.username,...

EUVD-2026-83922

nginx ignition is a user interface for the nginx web server. In versions 2.33.0 through 2.35.0, any user that has enabled the OTP 2FA can have their TOTP reused during the standard 30 second validity window. Version 2.35.1 patches the issue...

CVE-2026-82187

The Web to Print Online Designer WordPress plugin before 2.15.0 does not validate the type or extension of uploaded files, and hands the token protecting those uploads to any visitor who asks for it, allowing unauthenticated attackers to upload arbitrary files, including PHP ones, and run code on...

EUVD-2026-83839

The Web to Print Online Designer WordPress plugin before 2.15.0 does not validate the type or extension of uploaded files, and hands the token protecting those uploads to any visitor who asks for it, allowing unauthenticated attackers to upload arbitrary files, including PHP ones, and run code on...

webkitgtk: Processing maliciously crafted web content may lead to an unexpected process termination

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process termination due to improper state management...

webkitgtk: Validate the full FeatureList array once in OpenTypeVerticalData findFeature

A flaw was found in WebKitGTK. Processing malicious web content can cause memory corruption due to improper memory handling...

chromium-browser: angle: Chromium: Web origin policy bypass via uninitialized resource in ANGLE

A flaw was found in ANGLE, a component of Chromium. A remote attacker could exploit an uninitialized resource vulnerability by enticing a user to visit a specially crafted HTML page. This could potentially allow the attacker to bypass the web origin policy, leading to unauthorized access to...

webkitgtk: Processing maliciously crafted web content may lead to an unexpected Safari crash

A flaw was found in WebKitGTK. Processing malicious web content can cause an unexpected process crash due to improper memory handling...

PT-2026-96041

Name of the Vulnerable Software and Affected Versions Web to Print Online Designer WordPress plugin versions prior to 2.15.0 Description Insufficient validation of uploaded file types and extensions allows unauthenticated attackers to upload arbitrary files, including PHP scripts. Additionally, t...

CVE-2026-77522: Server-Side Request Forgery (SSRF)

MaxKB is an open-source AI assistant for enterprise. In version 2.10.3-lts and earlier, the knowledge web-document import and synchronization crawler passes an authenticated workspace user's URL to Fork.fork, which calls requests.get with verify=False and without restricting schemes, loopback,...

CVE-2026-49995: Improper Neutralization of Input During Web Page Generation

Tautulli is a Python based monitoring and tracking tool for Plex Media Server. Prior to 2.17.2, the newsletter cron field stored in the newsletters table is inserted by data/interfaces/default/newsletterconfig.html into a JavaScript string without safe JSON encoding. An administrator or caller wi...