CVE-2026-55179: Authorization Bypass Through User-Controlled Key

Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.7.2, Joplin Server's GET /items/:id/content route in packages/server/src/routes/index/items.ts loads item content from an attacker-supplied internal server ID without checking...

CVE-2026-91165: Improper Neutralization of Input During Web Page Generation

Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.27.6, the responsemode=formpost SSO return path in warpgate-protocol-http/src/api/ssoproviderlist.rs uses serdejson::tostring inside ReturnToSsoPostResponse without neutralizing a script-closing sequence. The...

CVE-2026-94110: Improper Neutralization of Special Elements used in an SQL Command

A security vulnerability has been detected in QCMS up to 6.0.6. This issue affects the function selfTmp in the library Lib/Config/Controllers.php of the component Content Detail Page. Such manipulation of the argument ID leads to sql injection. The attack may be performed from remote. The exploit...

CVE-2026-77517: Authorization Bypass Through User-Controlled Key

MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.10.2-lts, document and paragraph operate routes authorize only knowledgeid in the request path, then query the target Document by documentid or Paragraph by paragraphid without confirming that the object belongs to...

PT-2026-96030

Name of the Vulnerable Software and Affected Versions QCMS versions prior to 6.0.7 Description A remote SQL injection exists in the Content Detail Page component within the self Tmp function located in the Lib/Config/Controllers.php library. The issue occurs when the ID argument is manipulated...

CVE-2026-61541: Allocation of Resources Without Limits or Throttling

Zapros, a Python HTTP client, prior to version 0.14.0 is vulnerable to denial of service when an application requests content from an untrusted server, or follows a redirect to one, because a malicious response containing an excessive number of chained Content-Encoding values causes Zapros to...

PT-2026-96279

Name of the Vulnerable Software and Affected Versions Joplin Server versions prior to 3.7.7 Description An issue exists where the 'GET /shares/:id?resource id=' endpoint serves resources with an attacker-controlled mime value and omits the Content-Disposition header when the resource title is...

PT-2026-96283

Name of the Vulnerable Software and Affected Versions Zapros versions prior to 0.14.0 Description A denial of service occurs when an application requests content from an untrusted server or follows a redirect to one. A malicious response with an excessive number of chained Content-Encoding values...

PT-2026-96277

Name of the Vulnerable Software and Affected Versions Joplin Server versions prior to 3.7.2 Description An issue exists where the server loads item content from an internal server ID without verifying if the authenticated user has the necessary permissions to access that item. An authenticated us...

PT-2026-96224

Name of the Vulnerable Software and Affected Versions Warpgate versions prior to 0.27.6 Description The SSO return path using response mode=form post in the warpgate-protocol-http/src/api/sso provider list.rs file fails to neutralize script-closing sequences when using serde json::to string insid...

Linux Distros Unpatched Vulnerability : CVE-2026-93560

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A flaw was found in the Netty STOMP codec. A remote attacker could send a specially crafted STOMP frame with a content-length header exceeding the maximum integ...

RHEL 8 : abrt (RHSA-2026:69115)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69115 advisory. The Automatic Bug Reporting Tool ABRT recognizes defects in applications and creates bug reports that help maintainers fix the defects. ABR...

RHEL 8 : abrt (RHSA-2026:69117)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69117 advisory. The Automatic Bug Reporting Tool ABRT recognizes defects in applications and creates bug reports that help maintainers fix the defects. ABR...

RHEL 8 : abrt (RHSA-2026:69116)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:69116 advisory. The Automatic Bug Reporting Tool ABRT recognizes defects in applications and creates bug reports that help maintainers fix the defects. ABR...

SUSE SLED15 / SLES15 Security Update : httpcomponents-client (SUSE-SU-2026:4028-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2026:4028-1 advisory. This update for httpcomponents-client fixes the following issue: - CVE-2026-64607: improper release of underlying...

uBlock v1.75.1b0

!Badge CommitsCommit Rate !Badge IssuesIssues !Badge LocalizationCrowdin !Badge LicenseLicense !Badge NPMNPM !Badge MozillaMozilla !Badge ChromeChrome !Badge EdgeEdge uBlock Origin uBO Browser| Install from ...| Status ---|---|--- | Firefox Add-ons| uBO works best on Firefox | Edge Add-ons| "Movi...

OPENSUSE-SU-2026:21894-1 Security update for httpcomponents-client

This update for httpcomponents-client fixes the following issue: - CVE-2026-64607: improper release of underlying connection back to connection manager when an invalid or unsupported Content-Encoding header value in a response message bsc1273163...

EUVD-2026-83770

A vulnerability was identified in 03-lovepreetSingh MCP up to f95d035c5317fad81af9828286631053ccb23546. This issue affects the function createfile of the file app/api/mcp/route.ts. Such manipulation of the argument filePath/content leads to path traversal. The attack can be launched remotely. The...

CVE-2026-94044 03-lovepreetSingh MCP route.ts create_file path traversal

A vulnerability was identified in 03-lovepreetSingh MCP up to f95d035c5317fad81af9828286631053ccb23546. This issue affects the function createfile of the file app/api/mcp/route.ts. Such manipulation of the argument filePath/content leads to path traversal. The attack can be launched remotely. The...

OESA-2026-3955 python-jupyter-server security update

The backend for Jupyter web applications Security Fixes: The nbconvert HTTP handlers in jupyterserver render user-authored notebook HTML under the Jupyter origin without a sandbox directive in their Content-Security-Policy. Combined with nbconvert.HTMLExporter's default non-sanitizing behavior, a...