CVE-2026-44901 Wazuh Cluster DAPI Protocol Deserialization of Untrusted Data Remote Code Execution Vulnerability

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.0.0 until 4.14.6 and 5.0.0-beta2, AffectedItemsWazuhResult.merge in framework/wazuh/core/results.py trusts the sortcasting field in a cluster worker's JSON response. During a distributed API merge...

MINI-3WR5-J78M-CR4V

Bulletin has no description...

EUVD-2026-62549

Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to calluserfuncarray without rejecting dangerous callback parameters. An account with admin.pages or...

CVE-2026-64850

In Grav prior to 2.0.7, Blueprint::dynamicData() in system/src/Grav/Common/Data/Blueprint.php passes an editor-controlled callable to call_user_func_array() without filtering dangerous callbacks. A user with admin.pages or api.pages.write privileges can use arrayFilterRecursive() as a trampoline ...

CVE-2026-64850 Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()

Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to calluserfuncarray without rejecting dangerous callback parameters. An account with admin.pages or...

CVE-2026-64850 Grav: Remote code execution via unrestricted callable in Blueprint::dynamicData()

Grav is a file-based Web platform. Prior to 2.0.7, Grav Blueprint::dynamicData in system/src/Grav/Common/Data/Blueprint.php sends an editor-controlled Class::method provider and arguments to calluserfuncarray without rejecting dangerous callback parameters. An account with admin.pages or...

MINI-XPH6-PFRX-8JMH

Bulletin has no description...

MINI-RVHF-R9J9-F768

Bulletin has no description...

MINI-3QP8-H8V4-XWMH

Bulletin has no description...

MINI-57XG-6P9C-6699

Bulletin has no description...

MINI-67VR-9F29-FRGF

Bulletin has no description...

MINI-VW5R-C6F7-9C56

Bulletin has no description...

MINI-VJPG-5VFH-6JP9

Bulletin has no description...

MINI-6Q5C-WW5F-P86V

Bulletin has no description...

MINI-V8G4-5VGQ-88RR

Bulletin has no description...

kernel: dlm: validate length in dlm_search_rsb_tree

A flaw was found in the Linux kernel's Distributed Lock Manager dlm module. An attacker could send specially crafted network messages with an oversized length parameter to the dlmdumprsbname function. This lack of validation can lead to an out-of-bounds write in the dlmsearchrsbtree function,...

MINI-66FC-XMQ3-WCPQ

Bulletin has no description...

MINI-258P-7FXQ-H4G8

Bulletin has no description...

CVE-2026-52792

Algernon is a small self-contained pure-Go web server. Prior to 1.17.9, Algernon on Windows selects a file handler in engine/handlers.go by calling filepath.Ext without first rejecting NTFS-equivalent names such as x.lua::$DATA, x.lua., and x.lua . An unauthenticated client can append one of thes...

CVE-2026-52889

Formie is a Craft CMS plugin for creating forms. Prior to 3.1.27, Formie can pass request-derived Hidden field defaults such as HTTP User Agent, Referer URL, Current URL, Current URL without Query String, Query Parameter, and Cookie Value to Craft's Twig rendering layer during front-end form...