PT-2026-67314

Name of the Vulnerable Software and Affected Versions better-auth versions prior to 1.6.11 @better-auth/scim versions prior to 1.6.11 Description When secondaryStorage is configured and storeSessionInDatabase is set to false, certain user-deletion processes fail to remove cached sessions. This...

HPESBNW05038 rev.1 - HPE Networking Instant On Switch Remote Unauthenticated Disclosure of Cryptographic Secrets

Potential Security Impact: Local: Access Restriction Bypass SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. Aruba Instant On 1930 Switch Series - Please refer to the Vulnerability Summary for Affected Version Information Affected Products HPE Networking Instant On 1830, 1930, and...

CVE-2026-53644 FOSSBilling's missing order-state validation allows clients to read and reset API key secrets for non-active orders

FOSSBilling is a free, open-source billing and client management system. Versions 0.5.3 through 0.7.2 allow authenticated clients to both read and reset API key service secrets for orders that are no longer in an active state e.g., suspended, canceled. The root cause is missing order-state...

20mk-utils (>=1.0.0, <=1.0.3), 2d-spirograph (>=1.0.2, <=1.0.4) +2100 more potentially affected by CVE-2026-59711 via showdown (>=0.0.1, <=2.1.0)

showdown NPM version =0.0.1, =1.0.0, =1.0.2, =2.0.4, =1.0.6, =13.351.0, =13.351.0, =7.10.0, =7.10.0, =0.0.3, =1.0.0, =0.0.1, =0.0.39 and more Source cves: CVE-2026-59711 Source advisory: SNYK:JS-SHOWDOWN-17874448...

CVE-2026-34167

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the ActivityMonitor Livewire component exposes a public $activityId property without Livewire's Locked attribute. It loads activities via Activity::find$this-activityId wit...

Security Bulletin: IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is affected by an arbitrary file read vulnerability (CVE-2026-11806)

Summary IBM WebSphere Application Server Liberty, which is bundled with IBM WebSphere Hybrid Edition, is affected by an arbitrary file read vulnerability with the restConnector-2.0 feature enabled. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section...

CVE-2026-54763

Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares strip canonical-cased spoofed identity headers before writing Traefik's own value, but do not account for underscore-variant header names, which...

GHSA-Q6H5-Q3Q6-F87X CiliumLocalRedirectPolicy addressMatcher allows cross-namespace service traffic hijacking and can break service translation

Impact Users with the ability to create CiliumLocalRedirectPolicies can specify arbitrary ClusterIPs via addressMatcher, which enables hijacking traffic to Services in any namespace, bypassing the namespace-scoping guarantees enforced by serviceMatcher. In addition, deleting such a policy can...

CVE-2026-54763

Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's BasicAuth, DigestAuth, and ForwardAuth middlewares strip canonical-cased spoofed identity headers before writing Traefik's own value, but do not account for underscore-variant header names, which...

CVE-2026-54764 ForwardAuth middleware leaks X-Forwarded-Port spoofing via untrusted X-Forwarded-Proto when trustForwardHeader=false

Traefik is an HTTP reverse proxy and load balancer. Prior to v2.11.51, v3.6.22, and v3.7.6, Traefik's ForwardAuth middleware, even when configured with trustForwardHeader: false, derives the X-Forwarded-Port header sent to the authentication service from the original incoming request instead of t...

CVE-2026-58403

Hugo is a static site generator. From v0.123.0 through v0.163.0, Hugo's virtual filesystem is designed so that files under a mount cannot reach outside the mount tree, but a regression caused RootMappingFs.statRoot to call Stat, which follows symlinks, instead of Lstat, so a direct os.ReadFile...

CVE-2026-50134

CVE-2026-50134 (Hugo) affects Hugo versions 0.91.0 through 0.161.1, where resources.GetRemote did not re-validate intermediate URLs on HTTP 3xx redirects despite enforcing security.http.urls on the initial URL. This allowed a redirect to an allowed host (or an attacker-controlled DNS/response) th...

Malicious code in tailwindcss-framer-motion (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c6dc5a8dd698d8d64c33611de6927d9f3df6f24d8948f0b9ed4ec9ca66c62e18 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in secure-box (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fac79042697157915144f205c342b79f8a019218c45580224a85c045c03fea9 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6873 Malicious code in router-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f60a60e68f645bffe7eb5e137979aa6fb6c535c53ee6e13a9fcf01951eb05b55 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-6834 Malicious code in df-vision (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0f31f7bc1ea70d57f022adc0005cee3e7e6190a458d9bc57a84b1c2966979db7 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-6810 Malicious code in chalk-prettier (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a36409ecc80ae4c159621da4530caf78fa06d5003dd2a55e18da3ae92b434cfa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Formie Hidden field defaults vulnerable to Server-Side Template Injection

Summary Formie Hidden fields could evaluate request-derived values as Twig during front-end form rendering. When a Hidden field used a dynamic default value such as HTTP User Agent, Referer URL, Current URL, Query Parameter, or Cookie Value, the value was copied from the incoming request and late...

GHSA-565M-G33J-JQ96 Formie Hidden field defaults vulnerable to Server-Side Template Injection

Summary Formie Hidden fields could evaluate request-derived values as Twig during front-end form rendering. When a Hidden field used a dynamic default value such as HTTP User Agent, Referer URL, Current URL, Query Parameter, or Cookie Value, the value was copied from the incoming request and late...

GHSA-55F6-PF8R-C2F4 Open Babel has out-of-bounds write in MOPAC translationVectors[] (UNIT CELL TRANSLATION)

Summary A memory-safety vulnerability in Open Babel's MOPAC output parser allowed an out-of-bounds write into the translationVectors array when reading the "UNIT CELL TRANSLATION" block of a crafted input file. Details The MOPAC output reader stored translation vectors from the UNIT CELL...