PT-2026-52849

Name of the Vulnerable Software and Affected Versions Canonical LXD versions 4.12 through 6.9 Description A Server-Side Request Forgery SSRF issue exists in the image import functionality. Authenticated users possessing the can create images entitlement can interact with internal network...

PT-2026-52898

Name of the Vulnerable Software and Affected Versions Cudy LT300 3.0 versions prior to 2.5.12 Description Authenticated attackers can execute arbitrary commands on the underlying system by injecting shell metacharacters into the cbid.system.ntp.current POST parameter within the system time...

PT-2026-52664

Name of the Vulnerable Software and Affected Versions YMC Filter WordPress plugin versions prior to 3.11.3 Description An issue exists where the software fails to properly authorize access to a REST API endpoint and does not validate a user-supplied query parameter. This allows unauthenticated...

PT-2026-52979

Name of the Vulnerable Software and Affected Versions Kestra versions prior to 1.0.45 Kestra versions prior to 1.3.21 Description An authentication bypass exists in the AuthenticationFilter of Kestra OSS. The system uses a suffix match via request.getPath.endsWith"/configs" to whitelist the publi...

PT-2026-52984

Name of the Vulnerable Software and Affected Versions Kestra versions prior to 1.0.45 Kestra versions prior to 1.3.21 Description The authentication filter for the REST API endpoint /api/v1/ incorrectly treats any request path ending in /configs as a public instance-config endpoint, allowing it t...

SUSE SLES16 Security Update : python-PyJWT (SUSE-SU-2026:22170-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:22170-1 advisory. This update for python-PyJWT fixes the following issues - CVE-2026-48522: PyJWKClient passes URI arguments directly to...

CVE-2026-42342

A flaw was found in React Router and @remix-run/server-runtime. A remote attacker can exploit this vulnerability by sending certain crafted requests to the manifest endpoint. This can lead to unbounded path expansion, consuming disproportionate server resources. The primary consequence is a denia...

CVE-2026-43920

CVE-2026-43920 affects FOSSBilling versions 0.5.4–0.7.2 where the unauthenticated /run-patcher endpoint allowed privileged maintenance operations (config migrations, DB schema changes including ALTER/DROP/UPDATE, filesystem deletions/renames, and cache clearing) to be executed without admin auth,...

CVE-2026-43920

FOSSBilling is a free, open-source billing and client management system. In versions 0.5.4 through 0.7.2, the /run-patcher maintenance endpoint in FOSSBilling was accessible without authentication, which allowed unauthenticated remote users to trigger update patch routines that modify configurati...

CVE-2026-43920 FOSSBilling: Unauthenticated update patcher endpoint allows remote maintenance execution

FOSSBilling is a free, open-source billing and client management system. In versions 0.5.4 through 0.7.2, the /run-patcher maintenance endpoint in FOSSBilling was accessible without authentication, which allowed unauthenticated remote users to trigger update patch routines that modify configurati...

CVE-2026-43920 FOSSBilling: Unauthenticated update patcher endpoint allows remote maintenance execution

FOSSBilling is a free, open-source billing and client management system. In versions 0.5.4 through 0.7.2, the /run-patcher maintenance endpoint in FOSSBilling was accessible without authentication, which allowed unauthenticated remote users to trigger update patch routines that modify configurati...

GO-2026-5757 MinIO vulnerable to Path Traversal via msgpack Body in `ReadMultiple` Storage-REST Endpoint in github.com/minio/minio

MinIO vulnerable to Path Traversal via msgpack Body in ReadMultiple Storage-REST Endpoint in github.com/minio/minio. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive...

GO-2026-5776 FileBrowser: Missing Rate Limiting on Authentication Endpoint Enables Brute Force Attacks in github.com/gtsteffaniak/filebrowser

FileBrowser: Missing Rate Limiting on Authentication Endpoint Enables Brute Force Attacks in github.com/gtsteffaniak/filebrowser. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing...

GO-2026-5746 Docker: 'PUT /containers/{id}/archive' executes container binary on the host in github.com/docker/docker

The Docker daemon's implementation of the "PUT /containers/id/archive" endpoint executes a container binary on the host when extracting an archive to a container. On Unix-like systems, this can be exploited if an attacker can control the container's filesystem or the archive being extracted,...

GO-2026-5696 Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel in github.com/enchant97/note-mark/backend

Note Mark: Username Enumeration via Login Endpoint Timing Side-Channel in github.com/enchant97/note-mark/backend. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports...

GO-2026-5682 Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint in github.com/fleetdm/fleet

Fleet has observer-level enrollment secret extraction via ORDER BY oracle on labels host-listing endpoint in github.com/fleetdm/fleet...

GO-2026-5678 Obot has an authorization bypass in /mcp-connect/{id} that allows any authenticated user to use any registered MCP server in github.com/obot-platform/obot

Obot has an authorization bypass in /mcp-connect/id that allows any authenticated user to use any registered MCP server in github.com/obot-platform/obot...

GO-2026-5680 ShellHub has cross-tenant IDOR in `GET /api/namespaces/:tenant` via API Key bypasses membership check in github.com/shellhub-io/shellhub

ShellHub has cross-tenant IDOR in GET /api/namespaces/:tenant via API Key bypasses membership check in github.com/shellhub-io/shellhub...

GO-2026-5739 Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint in github.com/fleetdm/fleet

Fleet: Observer-level enrollment secret extraction via ORDER BY oracle on Apple MDM commands endpoint in github.com/fleetdm/fleet...

GO-2026-5560 podinfo: cross-site scripting vulnerability in the /echo and /api/echo endpoints in github.com/stefanprodan/podinfo

podinfo: cross-site scripting vulnerability in the /echo and /api/echo endpoints in github.com/stefanprodan/podinfo...