CVE-2026-89286 FormFlow for GoHighLevel <= 1.0.0 - Unauthenticated Sensitive Data Disclosure via Log File

The FormFlow for GoHighLevel GHL WordPress plugin through 1.0.0 does not restrict access to a log file it writes inside the publicly accessible uploads directory, allowing unauthenticated attackers to read its contents, which include connected-CRM identifiers and, on sites that have linked the...

Important: Red Hat Security Advisory: openssl security update

An update for openssl is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls

A flaw was found in OpenSSL. When applications directly call the low-level CRYPTOocb128encrypt or CRYPTOocb128decrypt functions with non-block-aligned lengths in a single call on hardware-accelerated builds, the trailing 1-15 bytes of a message may be exposed in cleartext. These exposed bytes are...

openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls

A flaw was found in OpenSSL. When applications directly call the low-level CRYPTOocb128encrypt or CRYPTOocb128decrypt functions with non-block-aligned lengths in a single call on hardware-accelerated builds, the trailing 1-15 bytes of a message may be exposed in cleartext. These exposed bytes are...

Important: Red Hat Security Advisory: openssl security update

An update for openssl is now available for Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Multiple vulnerabilities in IBM Java SDK affect AIX

IBM SECURITY ADVISORY First Issued: Mon Oct 19 04:45:00 CDT 2026 The most recent version of this document is available here: https://aix.software.ibm.com/aix/efixes/security/javaoct2026advisory.asc Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect AIX...

cockpit-files: cockpit-files: Arbitrary file ownership change via symlink following in privileged paste

A flaw was found in cockpit-files. A low-privileged local user can exploit this vulnerability by crafting a directory containing a symbolic link symlink and then using the privileged "Paste as owner" function. This allows for arbitrary file ownership changes outside the intended pasted directory,...

MAL-2026-17927 Malicious code in fabtoolkit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e55333b9d934a04c029943e0e6fbf34fff7c1344e0d1964b6860bc02d322855d fabtoolkit executes a payload embedded as a CHILD string run via subprocess.runsys.executable,'-I','-c',CHILD,... that fetches a JSON config from...

store-api

RESTful API auto-generation for common-store data layer fastify + fastapi adapters over GQL, spec-driven dual-runtime parity...

PT-2026-117446

Dell Application Installer, versions prior to 26.09.0.1, contain a Missing Encryption of Sensitive Data vulnerability. An unauthenticated attacker with local access could potentially exploit this vulnerability, leading to Unauthorized access...

PT-2026-117356

Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Signing material belonging to an individual request was stored in state that is shared across requests rather than confined ...

PT-2026-132666

TuxCare rebuilt org.springframework.data:spring-data-keyvalue to address 1 CVE. Fixed in 3.3.12-tuxcare.3...

PT-2026-117673

Name of the Vulnerable Software and Affected Versions Pillow versions 9.2.0 through 12.11.0 Description When saving a GIF with a long comment, the library performs quadratic copying. The get global header function repeatedly copies portions of comment data while assembling the global header, whic...

CVE-2026-112308: Server-Side Request Forgery (SSRF)

crewai-tools through 1.15.28 contains a server-side request forgery vulnerability in SeleniumScrapingTool that allows attackers to fetch internal resources because it never applies the validateurl private-address check. Attackers influencing agent tool input through prompt injection can direct...

CVE-2026-12254: Insufficient Session Expiration

Netskope is notified about a potential gap in its agent NSClient where a system with Netskope Client while connecting to an access point with Captive Portal switches to a Network which already has internet connectivity, the Captive Portal does not close. This allows the possibility of abuse via t...

Red Hat: CVE-2026-112404: pillow: Pillow: Denial of Service via out-of-bounds read in TIFF decoding

Pillow is a Python imaging library. From 8.1.0 until 13.0.0, Pillow's TIFF tile and RGBA decode paths can read beyond row data produced by libtiff. In decodeTile and the RGBA unpacker path, when Pillow and libtiff interpret duplicated PhotometricInterpretation or BitsPerSample tags differently,...

CVE-2026-85260: Insertion of Sensitive Information into Log File

Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-mllp component carries a logPhi option that governs whether HL7 payload content may be written to the log...

CVE-2026-112260: Out-of-bounds Read

A flaw was found in GIMP. Opening a crafted XCF with a malformed text-layer parasite can cause a heap out-of-bounds read, disclosing adjacent heap data into layer text and causing denial of service...

CVE-2026-111439: Missing Authorization

在 openGauss-server的 src/common/backend/utils/adt/genfile.cpp 模块中，内置函数 pgreadbinaryfileblocks 存在权限校验逻辑缺陷。该函数在入口处仅校验了起始块号（startBlockNum）和块数量（blockCount）的范围，随后直接调用底层文件读取例程 ReadBinaryFileBlocksFirstCall。该底层例程仅执行了路径规范化检查以及针对 .. 路径遍历和数据目录边界的基本检查，缺失了对调用者数据库权限（如 SELECT 权限）的校验。此外，辅助函数 isrowdatafile...

SLiMS 9 Bulian security vulnerability

SLiMS 9 Bulian version 9.8.0 contains a security vulnerability. This vulnerability arises because the action=run GET parameter in admin/modules/circulation/loanhistorymaintenance.php executes privileged and destructive operations without using a CSRF token or POST validation. As a result, it may...