CVE-2026-105801

A flaw was found in openapi-python-client. The generator fails to properly sanitize input from OpenAPI specification documents before rendering code strings and docstrings into generated Python files. An attacker could supply a specially crafted specification to inject arbitrary Python code,...

CVE-2026-34038

CVE-2026-34038: Authenticated Remote Command Injection in Coolify This repository contains documentation and analysis for CVE-2026-34038 , a critical command injection vulnerability in Coolify. Summary An authenticated remote command injection vulnerability CWE-78 in Coolify allows users with...

CVE-2026-106499

A flaw was found in the Backstage Scaffolder backend. In environments configured with default environment secrets, an authenticated attacker with permissions to create or modify templates can cause secret-derived values to be recorded in task logs. This issue leads to information disclosure,...

MiracleLinux 8 : sudo-1.9.5p2-2.el8_10 (AXSA:2026-1977:06)

The remote MiracleLinux 8 host has a package installed that is affected by a vulnerability as referenced in the AXSA:2026-1977:06 advisory. sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization CVE-2026-96512 Tenable has extracted the preceding descripti...

CVE-2026-106556: Improper Neutralization of Special Elements used in an OS Command

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an...

MiracleLinux 9 : sudo-1.9.17p2-3.el9_8.3 (AXSA:2026-1990:07)

The remote MiracleLinux 9 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2026-1990:07 advisory. sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization CVE-2026-96512 Tenable has extracted the preceding descripti...

PT-2026-107532

Backstage is an open framework for building developer portals. Prior to 1.14.6, the @backstage/plugin-techdocs-node package is affected by configuration bypass in techdocs mkdocs.yml sanitization. Insufficient validation of MkDocs configuration during TechDocs generation could allow an...

Faraday 5.25.0

Faraday is a tool that introduces a new concept called IPE, or Integrated Penetration-Test Environment. It is a multiuser penetration test IDE designed for distribution, indexation and analysis of the generated data during the process of a security audit. The main purpose of Faraday is to re-use...

Rocky Linux 10.2 [CIQ] Security Update: sudo / sudo-debuginfo / sudo-debugsource / sudo-python-plugin / etc (crlsa-2026_75579)

The Rocky Linux 10.2 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202675579 advisory. sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization CVE-2026-96512 Tenable has extracted the preceding description...

Rocky Linux 8 [CIQ] Security Update: sudo / sudo-debuginfo / sudo-debugsource (crlsa-2026_75580)

The Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202675580 advisory. sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization CVE-2026-96512 Tenable has extracted the preceding description blo...

Rocky Linux 9 [CIQ] Security Update: sudo / sudo-debuginfo / sudo-debugsource / sudo-python-plugin / etc (crlsa-2026_75571)

The Rocky Linux 9 host has packages installed that are affected by a vulnerability as referenced in the CIQ crlsa-202675571 advisory. sudo: sudo: TZ environment variable allows bypass of NOTBEFORE/NOTAFTER time-based authorization CVE-2026-96512 Tenable has extracted the preceding description blo...

Malicious code in css-jptvix-polyfill (npm)

Source: amazon-inspector cea61788c370593a2720461d06b74942933d38d30b449851a05541b5b7f189aa The package ships thunderboltRegistry.js, a Proxy-based shim that exports names mimicking internal Wix thunderbolt modules thunderboltRegistry, siteAssetsRegistry, editorRegistry, corvidRegistry,...

CVE-2026-106106

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env,...

CVE-2026-63270

A flaw was found in LibreOffice. This vulnerability allows information disclosure when a user opens a specially crafted document. An attacker can construct malicious URLs within document features that expand local environment variables or configuration settings, enabling the exfiltration of...

CVE-2026-106106 Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env,...

CVE-2026-106106 Quasar Framework: SSR/SSG dev error page discloses the full shell environment and its </script> escape is bypassable

Quasar Framework is a framework for building high-performance Vue.js user interfaces. Prior to @quasar/render-ssr-error 2.2.4 and @quasar/app-vite 3.3.0, renderSSRError in utils/render-ssr-error/src/index.js used diagnostic data from utils/render-ssr-error/src/env.js to serialize process.env,...

sudo security update

An update is available for sudo. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The sudo packages contain the sudo utility which allows system administrators t...

RLSA-2026:75579 Important: sudo security update

The sudo packages contain the sudo utility which allows system administrators to provide certain users with the permission to execute privileged commands, which are used for system management purposes, without having to log in as root. Security Fixes: sudo: sudo: TZ environment variable allows...

BIT-VIRTUALENV-2026-102938 virtualenv writes prompt values into pyvenv.cfg without sanitizing line boundaries, allowing configuration injection

virtualenv is a tool for creating isolated virtual python environments. Prior to 21.7.11, PyEnvCfg.write writes prompt values verbatim to the line-oriented pyvenv.cfg format while PyEnvCfg.readvalues parses the file with str.splitlines and accepts the last value for duplicate keys. An attacker wh...

CVE-2026-105701

The ACPT Premium plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 2.0.66 via the render function. This is due to missing capability check on the REST API form creation endpoint and unsandboxed Twig environment rendering email templates. This makes ...