BELL-CVE-2026-31395

Bulletin has no description...

BELL-CVE-2026-31390

Bulletin has no description...

BELL-CVE-2026-23430

Bulletin has no description...

@altipla/directus-sdk-utils (0.7.2), @bicou/directus-extension-imagga (>=1.6.3, <=1.6.6) +5 more potentially affected by CVE-2026-35408 via directus (>=11.0.0, <=11.16.1)

directus NPM version =11.0.0, =1.6.3, =20.0.0-rc.0, =34.0.1 - @fahami/directus-pkce 1.0.0 - abcprotocol 0.0.1 Source cves: CVE-2026-35408 Source advisory: SNYK:JS-DIRECTUS-15907600...

py-strawberry-graphql -- Multiple vulnerabilities

The Strawberry GraphQL project reports: Strawberry up until version 0.312.3 is vulnerable to an authentication bypass on WebSocket subscription endpoints. The legacy graphql-ws subprotocol handler does not verify that a 'connectioninit' handshake has been completed before processing start...

PT-2026-40436

Name of the Vulnerable Software and Affected Versions cPanel affected versions not specified Description Incorrect privileges management and insufficient path filtering in the cpdavd service allow a remote, unauthenticated attacker to read arbitrary files on the server as root. This is achieved...

CVE-2026-34775 Electron: nodeIntegrationInWorker not correctly scoped in shared renderer processes

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.4, 40.8.4, and 41.0.0, the nodeIntegrationInWorker webPreference was not correctly scoped in all configurations. In certain process-sharing scenarios, workers...

CVE-2026-34766

CVE-2026-34766 affects Electron; the select-usb-device event callback did not validate the chosen device ID against the filtered device list presented to the handler. This could allow an app to select a device ID outside the renderer’s requested filters or exclusionFilters, potentially granting a...

CVE-2026-34769 Electron: Renderer command-line switch injection via undocumented commandLineSwitches webPreference

Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.0, 40.7.0, and 41.0.0-beta.8, an undocumented commandLineSwitches webPreference allowed arbitrary switches to be appended to the renderer process command line. Ap...

SUSE CVE-2026-34826

Rack is a modular Ruby web server interface. Prior to versions 2.2.23, 3.1.21, and 3.2.6, Rack::Utils.getbyteranges parses the HTTP Range header without limiting the number of individual byte ranges. Although the existing fix for CVE-2024-26141 rejects ranges whose total byte coverage exceeds the...

SUSE CVE-2026-34835

Rack is a modular Ruby web server interface. From versions 3.0.0.beta1 to before 3.1.21, and 3.2.0 to before 3.2.6, Rack::Request parses the Host header using an AUTHORITY regular expression that accepts characters not permitted in RFC-compliant hostnames, including /, ?, , and @. Because req.hos...

CVE-2026-34935 PraisonAI: OS Command Injection in MCPHandler.parse_mcp_command()

PraisonAI is a multi-agent teams system. From version 4.5.15 to before version 4.5.69, the --mcp CLI argument is passed directly to shlex.split and forwarded through the call chain to anyio.openprocess with no validation, allowlist check, or sanitization at any hop, allowing arbitrary OS command...

CVE-2026-34787

CVE-2026-34787 affects Emlog up to version 2.6.2. An LFI exists in admin/plugin.php (line 80) where the GET parameter $plugin is directly used in a require_once path without sanitization. If a CSRF bypass is possible, an attacker could include arbitrary PHP files from the server filesystem, enabl...

CVE-2016-15058

Hirschmann HiLCOS Classic Platform switches Classic L2E, L2P, L3E, L3P versions prior to 09.0.06 and Classic L2B prior to 05.3.07 contain a credential exposure vulnerability where user passwords are synchronized with SNMPv1/v2 community strings and transmitted in plaintext when the feature is...

JupyterHub has an Open Redirect Vulnerability

Affected Version JupyterHub = 5.4.3 Impact An open redirect vulnerability in JupyterHub =5.4.3 allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site outside JupyterHub instead of a...

GHSA-3VFF-HJQV-M7H8 JupyterHub has an Open Redirect Vulnerability

Affected Version JupyterHub = 5.4.3 Impact An open redirect vulnerability in JupyterHub =5.4.3 allows attackers to construct links which, when clicked, take users to the JupyterHub login page, after which they are sent to an arbitrary attacker-controlled site outside JupyterHub instead of a...

CVE-2025-68153

Juju vulnerability CVE-2025-68153 affects Juju versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19. An authenticated user, a machine, or a controller within a Juju controller could modify resources of an application across the entire controller. The issue is mitigated by upgrades to 2.9.56 or ...

CVE-2025-68152 Juju: Read All Controller Logs From Compromised Workload

Juju is an open source application orchestration engine that enables any application operation on any infrastructure at any scale through special operators called ‘charms’. From versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19, it is possible that a compromised workload machine under a Juju...

CVE-2025-68152

CVE-2025-68152 affects Juju, an open source application orchestration engine. The issue permits a compromised workload machine under a Juju controller to read any log file for any entity in any model at any level, affecting versions 2.9 to before 2.9.56 and 3.6 to before 3.6.19. The flaw is mitig...

JLSEC-2026-48

Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application. For example, a man-in-the-middle attacker could send a long error message that a human or screen-scraper user of psql mistake...