PT-2026-83315

StarRocks through 4.0.13 contains an information disclosure vulnerability in the query detail endpoint that returns unfiltered query history for all users. Authenticated attackers with low privileges can access full SQL text, execution plans, and profiling data from every query executed by other...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: wildfly-common (UTSA-2026-093018)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-093018 advisory. Apache Log4j2 2.0-beta9 through 2.15.0 excluding security releases 2.12.2, 2.12.3, and 2.3.1 JNDI features used in configuration, log messages, and parameters do not...

PT-2026-83281

Name of the Vulnerable Software and Affected Versions Flextype CMS versions prior to 1.0.0-dev Description An expression language injection exists that allows authenticated attackers with a valid API token to read arbitrary files. This occurs when unsanitized user input is passed to the Symfony...

PT-2026-83301

BISHENG before 2.6.0 contains a remote code execution vulnerability in the workflow run once endpoint that allows authenticated users to execute arbitrary Python code. Attackers can submit crafted Code node definitions to the POST /api/v1/workflow/run once endpoint, which executes them with exec...

CVE-2026-39944: Use of a Broken or Risky Cryptographic Algorithm

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2.4 and 19.2.6, the RADOS Gateway RGW protects STS session tokens with an AES-128-CBC handler that provides no message authentication, allowing an attacker who holds any valid ST...

PT-2026-83311

Stable Diffusion WebUI through 1.10.1 contains a credential disclosure vulnerability in the /sdapi/v1/cmd-flags endpoint that returns parsed command-line arguments including gradio auth and api auth values in cleartext. Unauthenticated attackers can access this endpoint to retrieve configured...

EUVD-2026-67885

Incorrect access control in the getDiagnosisCfg function of TOTOLINK T6 4.1.5cu.748B20211015 allows unauthenticated attackers to obtain diagnostic configuration and ping log contents via sending a crafted POST request to /cgi-bin/cstecgi.cgi...

PT-2026-83322

Zephyr's WireGuard VPN data-plane receive handler wg process data message in subsys/net/lib/wireguard/wg crypto.c validated the anti-replay counter too late. After AEAD decryption of a MESSAGE TRANSPORT DATA packet succeeded, the code committed several peer-state changes — update peer addr endpoi...

PT-2026-82832

openNDS before 11.0.0 is susceptible to unauthenticated OS command execution via shell command injection through the fas query parameter on the /opennds preauth/ endpoint because of libopennds.sh...

PT-2026-83332

Name of the Vulnerable Software and Affected Versions IBM Langflow OSS versions 1.0.0 through 1.11.1 Description Improper enforcement of security restrictions on the 'A2A' public endpoint allows a remote attacker to execute arbitrary code. Arbitrary code execution occurs when an attacker can run...

CVE-2026-19286: Improper Control of Generation of Code

IBM Langflow OSS 1.0.0 through 1.11.1 could allow a remote attacker to execute arbitrary code due to improper enforcement of security restrictions on the A2A public endpoint...

CVE-2026-82290: Authorization Bypass Through User-Controlled Key

Chainlit through 2.12.0 fails to validate ownership of feedback records in PUT and DELETE endpoints. Authenticated attackers can delete or modify other users' feedback by supplying arbitrary feedback identifiers, corrupting human-rating data used for model evaluation...

CVE-2026-78103: Improper Enforcement of Behavioral Workflow

WatchGuard Dimension provides a client-side lock/unlock UI control for management changes. The server-side configuration endpoint does not enforce this lock/unlock workflow state, allowing an authenticated administrator to submit configuration changes directly to the endpoint without first...

CVE-2026-82246: Server-Side Request Forgery (SSRF)

Budibase Server before 3.41.3 contains a server-side request forgery vulnerability in the query import endpoint that fails to validate user-supplied URLs before fetching content. Attackers can submit arbitrary URLs to retrieve responses from internal services including cloud metadata endpoints an...

PT-2026-83139

The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.21.0.1. This is due to insufficient input sanitization and output escaping of user-supplied data via the rocket beacon AJAX endpoint. This makes it possible for unauthenticated...

PT-2026-83295

Immich through 3.1.0 fails to properly enforce locked asset visibility when assets are locked through the single-asset endpoint, allowing them to remain accessible through shared albums and links. Attackers can read locked assets and their metadata by accessing existing shared albums or links,...

CVE-2026-51617

The TOTOLINK T6 router (version 4.1.5cu.748_B20211015 ) is susceptible to an incorrect access control vulnerability in the getSysStatusCfg function. An unauthenticated attacker can send a crafted POST request to /cgi-bin/cstecgi.cgi to extract sensitive information, including the firmware version...

CVE-2026-51661

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control flaw within the getPortForwardRules function. An unauthenticated attacker can exploit this by sending a crafted POST request to the /cgi-bin/cstecgi.cgi endpoint to obtain sensiti...

CVE-2026-51628

The TOTOLINK T6 router, running firmware version 4.1.5cu.748_B20211015 , is vulnerable to an incorrect access control issue in the getGenerateWiFiWpsPin function. An unauthenticated attacker can generate and retrieve a new WPS PIN by sending a crafted POST request to /cgi-bin/cstecgi.cgi. While t...

PT-2026-83307

Quivr versions through 0.0.322 fail to validate chat ownership in the GET /chat/chat id/history, DELETE /chat/chat id, and POST /chat/chat id/question/answer endpoints. Authenticated attackers can read other users' conversation histories including private knowledge base content, delete arbitrary...