PT-2026-107516

wger is a free, open-source workout and fitness manager. Prior to version 2.6, an authenticated attacker can inject arbitrary workout log entries into any other user's SlotEntry by supplying the victim's slot entry ID in a POST /api/v2/workoutlog/ request. The slot entry foreign key is not includ...

PT-2026-107629

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Passionate Programmer Peter WP Data Access allows Blind SQL Injection. This issue affects WP Data Access: from n/a through 5.5.82...

PT-2026-107545

Name of the Vulnerable Software and Affected Versions @backstage/plugin-kubernetes-backend versions prior to 0.21.8 Description Improper entity validation in a deprecated Kubernetes services endpoint allows an authenticated user with Kubernetes read permissions to access workload data beyond thei...

Linux Distros Unpatched Vulnerability : CVE-2026-106579

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a crafted image can bypass an...

Linux Distros Unpatched Vulnerability : CVE-2026-106566

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-32, delegate symlink cleanup does not check the...

Linux Distros Unpatched Vulnerability : CVE-2026-106580

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ImageMagick is free and open-source software used for editing and manipulating digital images. Prior to 7.1.2-31 and 6.9.13-56, a missing security-policy check ...

UBUNTU-CVE-2026-106446

Handlebars provides the power necessary to let users build semantic te...

CVE-2026-97680

IBM Langflow OSS versions 1.0.0 through 1.12.2 are affected by a vulnerability (CVE-2026-97680 ) caused by improper access control in the vertex result caching subsystem . This flaw could allow a remote authenticated attacker to obtain sensitive information or inject malicious data . To remediate...

CVE-2026-97680

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper access control in the vertex result caching subsystem...

CVE-2026-97680 Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper access control in the vertex result caching subsystem...

CVE-2026-97680 Langflow OSS is affected by multiple vulnerabilities

IBM Langflow OSS 1.0.0 through 1.12.2 could allow a remote authenticated attacker to obtain sensitive information or inject malicious data due to improper access control in the vertex result caching subsystem...

CVE-2026-106392

An information leak flaw was found in the WebAudio component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/514426571...

CVE-2026-102407

A flaw was found in Elasticsearch. An authenticated user with permissions for at least one resource can exploit improper access controls in the Modify Data Streams application programming interface API to alter unauthorized data streams. Successful exploitation allows the user to inject data or...

CVE-2026-106354

An improper resource exposure flaw was found in the Extensions component of the Chromium browser. Upstream bugs: https://issues.chromium.org/issues/511796554...

CVE-2026-65142

NVIDIA Model-Optimizer contains a vulnerability where an attacker may cause deserialization of untrusted data. A successful exploit of this vulnerability might lead to code execution, data tampering, denial of service, and information disclosure...

CVE-2026-106498

Backstage is an open framework for building developer portals. Prior to 3.5.1, 3.6.2, 3.7.2, 3.8.2 and 3.9.1, the @backstage/plugin-catalog-backend package is affected by improper url validation in catalog entity placeholder resolution. An authenticated Backstage user could craft a catalog entity...

CVE-2026-53939

A flaw was found in cjose. When encrypting a JSON Web Encryption JWE object using AES-CBC-HMAC algorithms, the library initializes the encryption key with all-zero bytes instead of generating a secure random key. As a result, an attacker who intercepts the encrypted message can decrypt sensitive...

CVE-2022-22965

Spring4Shell 漏洞 - CVE-2022-22965 📕 介绍 spring4shell 漏洞之所以如此命名，是因为在 2022 年初发现了 2 个并被攻击者广泛利用的漏洞。其中一个漏洞位于名为 "Spring Cloud Functions" 的框架组件中（不太严重），第二个更关键的组件位于框架核心，称为 "Spring Core"。由于这两个关键漏洞，社区开了一个玩笑，将其与 2021 年披露的另一个关键漏洞 Log4shell 联系起来。 它是如何工作的？ Spring MVC...

CVE-2026-106501 Backstage: Sensitive information exposure in Scaffolder

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may...

CVE-2026-106501 Backstage: Sensitive information exposure in Scaffolder

Backstage is an open framework for building developer portals. Prior to 3.3.1, 3.4.1, 4.0.3 and 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by sensitive information exposure in scaffolder. An authenticated Backstage user who can read another user's Scaffolder task may...