Curl 8.17.0 < 8.20.0 OCSP Stapling Bypass

The version of curl installed on the remote host is 8.17.0 prior to 8.20.0. It is, therefore, affected by an OCSP stapling bypass vulnerability: - When curl is told to use the Certificate Status Request TLS extension, often referred to as OCSP stapling, to verify that the server certificate is...

Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)

Summary Four GET endpoints under /api/templates in Arcane's Huma backend are registered without any Security requirement, allowing any unauthenticated network client to list and read the full Compose YAML and .env content of every custom template stored in the instance. Because Arcane's UI expose...

GHSA-CXX3-HR75-4Q96 Arcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)

Summary Four GET endpoints under /api/templates in Arcane's Huma backend are registered without any Security requirement, allowing any unauthenticated network client to list and read the full Compose YAML and .env content of every custom template stored in the instance. Because Arcane's UI expose...

@clerk/agent-toolkit (>=0.2.9-canary.v20251211104600, <=0.3.16-snapshot.v20260416221307), @clerk/astro (>=3.0.0-canary.v20251211104600, <=3.0.13-snapshot.v20260411110132) +10 more potentially affected by CVE-2026-42349 via @clerk/backend (>=3.0.0, <=3.2.13-canary.v20260417194309)

@clerk/backend NPM version =3.0.0, =0.2.9-canary.v20251211104600, =3.0.0-canary.v20251211104600, =2.0.0-canary.v20251211104600, =2.6.9-canary.v20251211104600, =0.0.1, =7.0.0-canary.v20251211104600, =2.0.0-canary.v20251211104600, =3.0.0-canary.v20251211104600, =1.0.0-canary.v20251211104600,...

@unhook/cli (>=0.9.3, <=0.15.0) potentially affected by CVE-2026-42349 via @clerk/backend (>=2.0.0, <=2.29.3)

@clerk/backend NPM version =2.0.0, =0.9.3, =0.15.0 Source cves: CVE-2026-42349 Source advisory: OSV:GHSA-W24R-5266-9C3C...

Unsound access to padding bytes while serializing date/time values using the Mysql backend

Diesel-async uses the mysql-async crate for interacting with Mysql compatible databases. This library already provides access to deserialized data for date/time releated types. Diesel-async then translated these deserialized data back to their serialized binary representation to hook into diesels...

RUSTSEC-2026-0138 Unsound access to padding bytes while serializing date/time values using the Mysql backend

Diesel-async uses the mysql-async crate for interacting with Mysql compatible databases. This library already provides access to deserialized data for date/time releated types. Diesel-async then translated these deserialized data back to their serialized binary representation to hook into diesels...

SUSE CVE-2026-42167

modsql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands e.g., COPY TO PROGRAM...

CVE-2026-41486 vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9...

GHSA-MW35-8RX3-XF9R vulnerabilities

Vulnerabilities for packages: tritonserver-backend-vllm-cuda-12.9...

@n8n/backend-test-utils (1.18.0) potentially affected by CVE-2026-42227 via @n8n/db (1.18.0)

@n8n/db NPM version 1.18.0 is affected by a known vulnerability. The following packages have a transitive dependency on @n8n/db and may be impacted: - @n8n/backend-test-utils 1.18.0 Source cves: CVE-2026-42227 Source advisory: SNYK:JS-N8NDB-16351626...

@n8n/backend-test-utils (>=1.0.0-rc.0, <=1.17.1) potentially affected by CVE-2026-42227 via @n8n/db (>=1.0.0, <=1.17.1)

@n8n/db NPM version =1.0.0, =1.0.0-rc.0, =1.17.1 Source cves: CVE-2026-42227 Source advisory: SNYK:JS-N8NDB-16351626...

PT-2026-36113

Name of the Vulnerable Software and Affected Versions i18next-http-middleware versions prior to 3.9.3 Description The software passes user-controlled lng and ns values from the getResourcesHandler function directly into i18next.services.backendConnector.loadlanguages, namespaces, … without...

PT-2026-37133

Name of the Vulnerable Software and Affected Versions CI4MS versions 0.26.0.0 through 0.31.6.0 Description A theme upload feature allows any authenticated backend user with theme-upload permission to achieve remote code execution RCE by uploading a crafted ZIP file. PHP files within the ZIP are...

CVE-2026-42167

modsql in ProFTPD before 1.3.9a allows remote attackers to execute arbitrary code via a username, in scenarios where there is logging of USER requests with an expansion such as %U, and the SQL backend allows commands e.g., COPY TO PROGRAM...

CVE-2026-41384 OpenClaw < 2026.3.24 - Environment Variable Injection via Workspace Config in CLI Backend

OpenClaw before 2026.3.24 contains an environment variable injection vulnerability in the CLI backend runner that allows attackers to inject malicious environment variables through workspace configuration. Attackers can craft malicious workspace configs to inject arbitrary environment variables...

CVE-2026-41384 OpenClaw < 2026.3.24 - Environment Variable Injection via Workspace Config in CLI Backend

OpenClaw before 2026.3.24 contains an environment variable injection vulnerability in the CLI backend runner that allows attackers to inject malicious environment variables through workspace configuration. Attackers can craft malicious workspace configs to inject arbitrary environment variables...

EUVD-2026-26093

OpenClaw before 2026.3.24 contains an environment variable injection vulnerability in the CLI backend runner that allows attackers to inject malicious environment variables through workspace configuration. Attackers can craft malicious workspace configs to inject arbitrary environment variables...

CVE-2026-41384 OpenClaw < 2026.3.24 - Environment Variable Injection via Workspace Config in CLI Backend

OpenClaw before 2026.3.24 contains an environment variable injection vulnerability in the CLI backend runner that allows attackers to inject malicious environment variables through workspace configuration. Attackers can craft malicious workspace configs to inject arbitrary environment variables...

CVE-2026-40552

mpGabinet is vulnerable to Remote Command Execution. An authorized user with access to the application and direct access to the backend database can achieve system command execution by uploading an attachment and modifying its storage path in the database to reference an attacker-controlled remot...