CVE-2026-53572 KEDA: PostgreSQL connection string parameter injection via incomplete whitespace escaping

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...

CVE-2026-53572

KEDA (Kubernetes-based Event Driven Autoscaling) is affected by a PostgreSQL connection string parameter injection in pkg/scalers/postgresql_scaler.go prior to version 2.20.0 . The root cause is that escapePostgreConnectionParameter() only quotes values containing a literal space, leaving tabs, n...

EUVD-2026-64131

KEDA is a Kubernetes-based Event Driven Autoscaling component. Prior to 2.20.0, pkg/scalers/postgresqlscaler.go constructs libpq-style connection strings from tenant-controlled host, port, userName, dbName, sslmode, and password values, while escapePostgreConnectionParameter only quotes values...

CVE-2026-62960 Git for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on Windows

Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transportgetremotebundleuri, fetchbundleuriinternal, and copyuritofile in bundle-uri.c during clone or fetch when transfer.bundleuri=true. Non-HTTPS values...

CVE-2026-62960 Git for Windows: Server-advertised bundle-uri can trigger outbound SMB callbacks via UNC and file:// paths on Windows

Git for Windows is the Windows port of Git. Prior to 2.55.0.windows.4, a malicious remote Git server can advertise a bundle URI that reaches transportgetremotebundleuri, fetchbundleuriinternal, and copyuritofile in bundle-uri.c during clone or fetch when transfer.bundleuri=true. Non-HTTPS values...

CVE-2026-62960

Git for Windows prior to 2.55.0.windows.4 is vulnerable to a security bypass in bundle-uri.c . When transfer.bundleuri=true, a malicious remote Git server can advertise a bundle URI processed by transport_get_remote_bundle_uri(), fetch_bundle_uri_internal(), and copy_uri_to_file(). Non-HTTP(S) va...

EUVD-2026-64067

In the Neptune connector, a user with access to Neptune through Athena Federated Query could gain access to properties in the Lambda supplying the compute for the connector. To remediate this issue, users should upgrade to aws-athena-query-federation v2026.30.1 or later...

EUVD-2026-64059

Joomla Extension - j2commerce.com - Cross-customer order replication in J2Store 1.0.0-3.3.20, 4.0.0-4.0.20, 4.1.0-4.1.5 - An authenticated user could supply another customer's orderid to copy their cart contents and address data into the attacker's session. The CSRF token was validated but...

CVE-2026-71862

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticated GET /api/v1/status-page/:url endpoi...

CVE-2026-71862 Checkmate: Sensitive Bearer Token Exposure via Public Status Pages When showURL Setting is Enabled

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticated GET /api/v1/status-page/:url endpoi...

CVE-2026-71862

Checkmate (open-source self-hosted monitoring tool) versions 3.3.0 through 3.9.2 are vulnerable to sensitive credential exposure . When the global showURL setting is enabled, the unauthenticated endpoint GET /api/v1/status-page/:url returns complete monitor objects from statusPageController.ts, i...

CVE-2026-71862 Checkmate: Sensitive Bearer Token Exposure via Public Status Pages When showURL Setting is Enabled

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticated GET /api/v1/status-page/:url endpoi...

EUVD-2026-64039

Checkmate is an open-source, self-hosted tool designed to track and monitor server hardware, uptime, response times, and incidents in real-time with beautiful visualizations. From 3.3.0 until 3.9.2, enabling the global showURL setting causes the unauthenticated GET /api/v1/status-page/:url endpoi...

CVE-2026-75928

The Brushfire platform's video content streaming application https://online.brushfire.com exposes database path in requests to users, allowing a remote, unauthenticated attacker to read information about other users. Fixed February 2026...

CVE-2026-75932 Jet Admin tenant isolation failure

Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traffic to the attacker-controlled app. Once connected to the target domain, the attacker's workspace is populated with the victim's OAuth...

DEBIAN-CVE-2026-62867

Incus is a system container and virtual machine manager. Prior to version 7.3.0, improper validation of user-provided block.createoptions in storage volume configuration leads to argument injection in the constructed filesystem creation command line. This allows a project-scoped user to inject...

CVE-2026-55622

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new projec...

EUVD-2026-63988

A vulnerability in the Calix EXOS firmware for the GS7 XGS GS5239XG residential router allows unauthenticated remote attackers to modify NAT port‑forwarding rules via the UPnP WANIPConnection service. The device exposes the MiniUPnPd control endpoint on the WAN interface on TCP port 5000 without...

CVE-2026-75501

The Calix GS7 XGS (GS5239XG) residential router running EXOS firmware 6.6.47 exposes its MiniUPnPd WANIPConnection service on the public WAN interface at TCP port 5000 without authentication. Unauthenticated remote attackers can send crafted SOAP requests to add, delete, or enumerate NAT port map...

CVE-2026-55622 Incus has a project restriction bypass in instance copy across projects

Incus is a system container and virtual machine manager. Prior to version 7.2.0, missing authorization checks exist for instance copying where an attacker knowing the name of a project that they don't have access to and the name of an instance in that project can copy the instance to a new projec...