RHEL 8 : lrzsz (RHSA-2026:83525)

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2026:83525 advisory. Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz...

GitLab 19.1 < 19.2.8 / 19.3 < 19.3.5 / 19.4 < 19.4.2 (CVE-2026-96893)

The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.2.8, 19.3 before 19.3.5, and 19.4 before 19.4.2 that, under certain conditions, could have allowed an authenticat...

PT-2026-114931

Incomplete List of Disallowed Inputs CWE-184 in the dangerous-extension confirmation of the archive object viewer peach.pas, grid obj open in PeaZip 10.5.0 through 11.2.0 on Windows allows an attacker who convinces a victim to open an entry of a crafted archive to execute a program, or an arbitra...

CVE-2026-104024: Incomplete List of Disallowed Inputs

Incomplete List of Disallowed Inputs CWE-184 in the dangerous-extension confirmation of the archive object viewer peach.pas, gridobjopen in PeaZip 10.5.0 through 11.2.0 on Windows allows an attacker who convinces a victim to open an entry of a crafted archive to execute a program, or an arbitrary...

PT-2026-114997

Name of the Vulnerable Software and Affected Versions OPNsense versions prior to 26.1.11 Description The OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view fail to apply quote-safe encoding to the common name of a client when...

Important: lrzsz security, bug fix, and enhancement update

Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems. Security Fixes: lrzsz: lrzsz: Arbitrary file overwrite via...

PT-2026-115280

Name of the Vulnerable Software and Affected Versions Archon versions 0.2.13 through 0.11.1 Description Missing authentication allows unauthenticated attackers to access the /api/ control API, which binds to 0.0.0.0 by default. Attackers with network access can send messages to the AI coding agen...

CVE-2026-58390: Improper Neutralization of Input During Web Page Generation

OPNsense is a FreeBSD based firewall and routing platform. Prior to version 26.1.11, the OpenVPN connection-status dashboard widget in src/opnsense/www/js/widgets/OpenVPNClients.js and the connection-status view place a client commonname into data-common-name attributes without quote-safe encodin...

PT-2026-115109

Name of the Vulnerable Software and Affected Versions Tianji versions prior to 1.31.29 Description The formatString function in src/server/utils/template.ts passes survey feedTemplate and monitor notification templates to the lodash template function while the default evaluate pattern is enabled....

ALSA-2026:83525 Important: lrzsz security, bug fix, and enhancement update

Lrzsz consisting of lrz and lsz is a cosmetically modified zmodem/ymodem/xmodem package built from the public-domain version of the rzsz package. Lrzsz was created to provide a working GNU copylefted Zmodem solution for Linux systems. Security Fixes: lrzsz: lrzsz: Arbitrary file overwrite via...

CVE-2026-111219: Improper Neutralization of CRLF Sequences

Netgate pfSense CE through 2.9.0 contains a newline injection vulnerability in servicespppoeedit.php that allows privileged users to inject mpd.secret entries via unvalidated username POST fields. Attackers with the PPPoE Server Edit privilege can add a line whose secret begins with '!', making...

CVE-2026-110846

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node reference form. Attackers holding an execution's resume token can approve waiting executions meant for others, runnin...

CVE-2026-110846

The automation tool n8n versions before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint. The root cause is a logic error where the system performs Send-and-Wait validation before normalizing an alternate node reference form (CWE-180). An attacker posses...

CVE-2026-110846 n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node reference form. Attackers holding an execution's resume token can approve waiting executions meant for others, runnin...

CVE-2026-110846 n8n before 2.41.4 and 2.42.1 Send-and-Wait HMAC Signature Bypass via Waiting-Webhook

n8n before 2.41.4 and 2.42.x before 2.42.1 contains a signature bypass in the waiting-webhook endpoint, which selects Send-and-Wait validation before normalising an alternate node reference form. Attackers holding an execution's resume token can approve waiting executions meant for others, runnin...

CVE-2026-54702

Markdown Preview Enhanced is a Markdown preview extension for Visual Studio Code. Prior to 0.8.30, the webview message handler in src/preview-provider.ts accepts an attacker-controlled command value and attacker-controlled args, constructs a command in the crossnote namespace, and invokes...

CVE-2026-55679

The WeGIA web manager for charitable institutions is vulnerable to a pre-authentication installer injection chain in versions prior to 3.8.6 . The vulnerability exists because the web/instalador/instalador.php endpoint processes unauthenticated POST data before config.php is created. In the Linux...

CVE-2026-55679 WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code Injection

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command execut...

CVE-2026-55679 WeGIA: Pre-auth Installer Injection Chain Enables Command Execution and Arbitrary PHP Code Injection

WeGIA is a web manager for charitable institutions. Prior to 3.8.6, the pre-installation web/instalador/instalador.php endpoint is reachable before config.php exists and processes unauthenticated installation POST data. In the Linux reinstall flow, a crafted usuario value reaches a command execut...

CVE-2026-85714

Stirling-PDF is a locally hosted web application that facilitates various operations on PDF files. Prior to 2.13.2, an authenticated administrator using the default H2 database and security mode can upload a crafted SQL file to POST /api/v1/database/import-database...