EUVD-2026-84576

A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects the function addwatchuisnapshot of the file changedetectionio/blueprint/addwatchui/init.py of the component Preview Endpoint. Performing a manipulation of the argument url results in server-side...

CVE-2026-95656 dgtlmoon changedetection.io Preview Endpoint __init__.py add_watch_ui_snapshot server-side request forgery

A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects the function addwatchuisnapshot of the file changedetectionio/blueprint/addwatchui/init.py of the component Preview Endpoint. Performing a manipulation of the argument url results in server-side...

CVE-2026-95656

The dgtlmoon changedetection.io software (up to version 50389b07 ) is vulnerable to a server-side request forgery (SSRF) vulnerability in the Preview Endpoint component. The flaw exists within the add_watch_ui_snapshot function of the file changedetectionio/blueprint/add_watch_ui/__init__.py, whe...

CVE-2026-95656 dgtlmoon changedetection.io Preview Endpoint __init__.py add_watch_ui_snapshot server-side request forgery

A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects the function addwatchuisnapshot of the file changedetectionio/blueprint/addwatchui/init.py of the component Preview Endpoint. Performing a manipulation of the argument url results in server-side...

CVE-2026-95656 dgtlmoon changedetection.io Preview Endpoint __init__.py add_watch_ui_snapshot server-side request forgery

A vulnerability was found in dgtlmoon changedetection.io up to 50389b07. This vulnerability affects the function addwatchuisnapshot of the file changedetectionio/blueprint/addwatchui/init.py of the component Preview Endpoint. Performing a manipulation of the argument url results in server-side...

CVE-2026-83597

The Netdata Windows Agent (versions 2.0.0 through 2.10.4) is vulnerable to a Local Privilege Escalation issue. During an MSI repair, the installer launches powershell.exe and wevtutil.exe as elevated interactive processes within the initiating user's desktop session. A low-privileged local user c...

CVE-2026-93381

A flaw was found in PDFium in Google Chrome. This buffer overflow vulnerability could be exploited by a remote attacker leveraging social engineering to trick a user into opening a specially crafted PDF file. Successful exploitation could potentially allow the attacker to execute arbitrary code...

CVE-2026-84301 FastGPT safe axios SSRF guard still allows DNS rebinding TOCTOU on protected outbound requests

FastGPT is an open-source LLM platform for building AI applications on a knowledge base. Prior to 4.15.2, the safe Axios request interceptor in packages/service/common/api/axios.ts validates a hostname with isInternalAddress before a later HTTP connection performs an independent DNS lookup,...

CVE-2026-93387

A flaw was found in Skia, a 2D graphics library, within Google Chrome. This vulnerability, stemming from improper state validation, allows a remote attacker to exploit it. By enticing a user to visit a specially crafted HTML page, the attacker can obtain sensitive cross-origin data...

CVE-2026-93375

A flaw was found in Google Chrome. This vulnerability, located in the Tracing component, involves incorrect reference resolution. A local attacker could exploit this flaw by using a local program, potentially leading to arbitrary code execution outside the browser's security sandbox...

CVE-2026-92597

A flaw was found in Nodemailer. This vulnerability allows a remote attacker to bypass email domain validation due to incorrect parsing of RFC 5322 comments in email addresses. Specifically, a malformed comment can cause Nodemailer to misinterpret the recipient's domain, leading to the delivery of...

SUSE CVE-2026-91147

A flaw was found in cockpit-ws. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending a specially crafted request. When the WebService.UrlRoot is configured and a request is made to the exact URL-root prefix without a trailing slash, cockpit-ws c...

SUSE CVE-2026-91149

A flaw was found in Cockpit. An unauthenticated remote attacker can exploit this vulnerability by initiating and sustaining numerous simultaneous connections to the cockpit-tls service. This forces the service to create an unbounded number of detached threads, consuming system resources such as...

SUSE CVE-2026-91202

A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link symlink and then using the privileged "Paste as owner" function. This allows for arbitrary file ownership changes outside the intended pasted directory,...

SUSE CVE-2026-91203

A flaw was found in cockpit-files. This vulnerability allows a local attacker to exploit a timing issue, known as a symlink race condition, during privileged file operations such as changing file ownership or permissions. By manipulating directory entries and winning this race, the attacker can...

CVE-2026-83803 Sentry: Unsafe pickle deserialization in Relocation Feature

Sentry is an error tracking and performance monitoring tool. From 23.11.0 until 26.7.0, Sentry instances with the relocation feature enabled unsafely deserialize a legacy database field while importing a user-supplied relocation archive. An authenticated user can craft an archive that causes...

AZL-105807 CVE-2026-94640 affecting package rpcbind 1.2.9-1

A flaw was found in rpcbind. This vulnerability allows a remote, unauthenticated attacker to cause a Denial of Service DoS by sending a large number of unique requests. The rpcbind service records previously unseen RPC Remote Procedure Call statistics in unbounded in-memory lists, leading to...

CVE-2026-85734 LightRAG: No Rate Limiting on /login Endpoint Allows Brute-Force Attacks

LightRAG provides simple and fast retrieval-augmented generation. Prior to 1.5.5, the POST /login endpoint in lightrag/api/lightragserver.py does not impose a rate limit, account lockout, delay, or counter for failed authentication attempts. A network attacker can submit password guesses at full...

CVE-2026-88010

Traefik is an open source HTTP reverse proxy and load balancer. From 3.6.11 until 3.7.13, checkPassword in pkg/middlewares/auth/basicauth.go constructs the BasicAuth singleflight key from the submitted password and stored secret. Concurrent requests for absent usernames therefore coalesce on one...

CVE-2026-86805

A time-of-check to time-of-use TOCTOU race condition in the dynamic loader ld.so of the GNU C Library glibc versions 2.14 through 2.44 allows a local attacker to escalate privileges. When expanding $ORIGIN in DTRPATH for setuid/setgid ATSECURE programs, glibc validates the lexically normalized...