CVE-2026-25946

Summary An unauthenticated Server-Side Request Forgery SSRF vulnerability in Gitea's OpenID authentication allows any remote attacker to make arbitrary HTTP requests to internal network services. This enables internal port scanning, service fingerprinting, and access to localhost-only resources...

kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()

A flaw was found in the Linux kernel's RDMA/mlx5 component. An error path fall-through in the mlx5ibdevressrqinit function, specifically when ibcreatesrq fails, can lead to the use of freed memory and error pointers. This memory corruption vulnerability could result in system instability, denial ...

kernel: RDMA/mlx5: Fix error path fall-through in mlx5_ib_dev_res_srq_init()

A flaw was found in the Linux kernel's RDMA/mlx5 component. An error path fall-through in the mlx5ibdevressrqinit function, specifically when ibcreatesrq fails, can lead to the use of freed memory and error pointers. This memory corruption vulnerability could result in system instability, denial ...

CVE-2025-25747-HotelDruid-3-0-7-Reflected-XSS

CVE-2025-25747 - Reflected XSS Vulnerability in HotelDruid 3.0.7 Description Cross Site Scripting vulnerability in DigitalDruid HotelDruid v.3.0.7 allows an attacker to execute arbitrary code and obtain sensitive information via the ripristinabackup parameter in the creabackup.php endpoint Severi...

CVE-2026-59976

ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convertto parameter to construct an output path. If an authenticated user, or an unauthenticated user when ConvertX is configured to allow unauthenticated access, uploads an...

CVE-2026-65954

PHPCSUtils is a suite of utility functions for use with PHPCodeSniffer. From 1.0.0-alpha1 until 1.2.3, PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey evaluates attacker-controlled array-key expressions with eval, allowing callback-form keys in untrusted PHP code scanne...

CVE-2023-49987

CVE-2023-49987 School Fees Management System v1.0 - Cross-Site Scripting XSS Vulnerability in "tname" parameter on "newterm" Description : A cross-site scripting XSS vulnerability in the component “newterm” of School Fees Management System 1.0 allow attackers to execute arbitrary web scripts or...

EUVD-2026-97779

PHPCSUtils is a suite of utility functions for use with PHPCodeSniffer. From 1.0.0-alpha1 until 1.2.3, PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey evaluates attacker-controlled array-key expressions with eval, allowing callback-form keys in untrusted PHP code scanne...

CVE-2026-65954

PHPCSUtils is a suite of utility functions for use with PHPCodeSniffer. From 1.0.0-alpha1 until 1.2.3, PHPCSUtils\AbstractSniffs\AbstractArrayDeclarationSniff::getActualArrayKey evaluates attacker-controlled array-key expressions with eval, allowing callback-form keys in untrusted PHP code scanne...

CVE-2026-18166

IBM Db2 versions 11.5.0 through 11.5.9 and 12.1.0 through 12.1.5 for Linux, UNIX, and Windows (including DB2 Connect Server ) are vulnerable to arbitrary library loading. The root cause is improper authorization when using the CREATE WRAPPER command, which could allow a remote authenticated attac...

CVE-2026-18166 IBM® Db2® is vulnerable to arbitrary library loading via the CREATE WRAPPER command, allowing a privileged database user to read sensitive files from the host filesystem

IBM Db2 11.5.0 through 11.5.9, and 12.1.0 through 12.1.5 for Linux, UNIX and Windows includes DB2 Connect Server could allow a remote authenticated attacker to obtain sensitive information due to improper authorization when using the CREATE WRAPPER command...

MGASA-2026-0487 Updated rsync package fixes security vulnerabilities

Several vulnerabilities were discovered in rsync, a fast, versatile, remote and local file-copying tool, which could result in local privilege escalation, bypass of intended access restrictions, information disclosure, denial of service or the execution of arbitrary code...

MGASA-2026-0486 Updated perl-DBI package fixes security vulnerabilities

DBI versions before 1.653 for Perl load arbitrary modules via unvalidated dbmtype and dbmmldbm attributes in DBD::DBM. CVE-2026-78030 DBI versions before 1.654 for Perl incorrectly treat numeric values as strings in sqltypecastsvpv. CVE-2026-88815 DBI versions before 1.654 for Perl incorrectly...

Updated rsync package fixes security vulnerabilities

Several vulnerabilities were discovered in rsync, a fast, versatile, remote and local file-copying tool, which could result in local privilege escalation, bypass of intended access restrictions, information disclosure, denial of service or the execution of arbitrary code...

CVE-2026-59976 ConvertX: Path Traversal vulnerability leading to Arbitrary File Write

ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convertto parameter to construct an output path. If an authenticated user, or an unauthenticated user when ConvertX is configured to allow unauthenticated access, uploads an...

CVE-2026-59976

The self-hosted file conversion service ConvertX is vulnerable to a path traversal vulnerability in versions prior to 0.18.0 . The ImageMagick converter fails to sanitize the convert_to parameter used to construct output paths. By uploading an extensionless image and providing directory traversal...

CVE-2026-59976 ConvertX: Path Traversal vulnerability leading to Arbitrary File Write

ConvertX is a self-hosted file conversion service. Prior to 0.18.0, the ImageMagick converter uses the unsanitized convertto parameter to construct an output path. If an authenticated user, or an unauthenticated user when ConvertX is configured to allow unauthenticated access, uploads an...

CVE-2026-77366

The obsidian-tc Model Context Protocol server is vulnerable to an authorization bypass in versions prior to 1.3.1 . The flaw occurs because tool dispatch fails to verify that the caller-controlled input.vault value matches the vault bound to the caller, compounded by a lack of vault claims in the...

CVE-2026-77366 obsidian-tc tokens can access arbitrary configured vaults

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, the JSON Web Token JWT has no vault claim, and the folder access-control list is...

CVE-2026-77366 obsidian-tc tokens can access arbitrary configured vaults

obsidian-tc is a governed, agent-ready Model Context Protocol server for Obsidian vaults. Prior to 1.3.1, tool dispatch does not compare the caller-controlled input.vault value with the vault bound to the caller, the JSON Web Token JWT has no vault claim, and the folder access-control list is...