MongoDB 7.0.x < 7.0.39 / 8.0.x < 8.0.28 / 8.3.x < 8.3.7 Improper Access Control (SERVER-127689)

The version of MongoDB installed on the remote host is 7.0.x prior to 7.0.39, 8.0.x prior to 8.0.28, or 8.3.x prior to 8.3.7. It is, therefore, affected by a vulnerability: - An authenticated user may be able to view session metadata belonging to other users on the system through the $listSession...

PT-2026-66607

Name of the Vulnerable Software and Affected Versions Sylius Mollie Plugin versions prior to 2.2.8 Sylius Mollie Plugin versions prior to 3.2.4 Sylius Mollie Plugin versions prior to 3.3.1 Description The software fails to perform ownership or session checks when looking up sequential orderId...

PT-2026-66459

A flaw was found in koku-metrics-operator. The operator's CostManagementMetricsConfig custom resource allows user able to edit the CR to specify an arbitrary upload URL. When authentication.type is set to token the default, the cluster-global Red Hat Cloud pull-secret bearer token is attached to...

Linux Distros Unpatched Vulnerability : CVE-2026-14643

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - undici's cache interceptor mishandles optional whitespace placed around the equals sign of a qualified no- cache or private Cache-Control directive. In undici...

PT-2026-66109

Uninitialized Use in ANGLE in Google Chrome on Windows prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Medium...

PT-2026-66324

Inappropriate implementation in WebXR in Google Chrome prior to 151.0.7922.72 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. Chromium security severity: Low...

PT-2026-66655

Impact In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process environment. That environment typically holds secret key base and often credentials for external systems, whic...

openssh: OpenSSH: `scp` file misplacement vulnerability during remote copy

A flaw was found in OpenSSH, a widely used tool for secure remote access. When a user attempts to copy files between two different remote systems using the scp command, the file might be incorrectly placed in a directory above the intended destination. This unintended file placement could lead to...

Security Bulletin: consul-mcp-server vulnerable to server side request forgery leading to token exposure

Summary In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied, allowing a connected client to override the server's configured Consul address via a request header. This may allow a malicious client to redirect the server's Consul API traffic...

CVE-2026-67439

OliveTin gives safe and simple access to predefined shell commands from a web interface. Prior to 3000.17.0, the service/internal/api/api.go StartActionAndWait and StartActionByGetAndWait endpoints return full LogEntry output after execution without enforcing the logs permission, allowing a user...

CVE-2026-6267

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Developer role to access unauthorized information due to insufficient access...

CVE-2026-46678

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.56.0 through 1.98.0, when an application opts a URL into forcedownload='allow-local' disabling the default block on private/internal IPs, the cloud-metadata blocklist could be bypassed by encoding the...

CVE-2026-46678 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.56.0 through 1.98.0, when an application opts a URL into forcedownload='allow-local' disabling the default block on private/internal IPs, the cloud-metadata blocklist could be bypassed by encoding the...

CVE-2026-46678 Pydantic AI: SSRF cloud-metadata blocklist bypass via IPv4-mapped IPv6 (Incomplete fix of CVE-2026-25580)

Pydantic AI is a Python agent framework for building Generative AI applications. In versions 1.56.0 through 1.98.0, when an application opts a URL into forcedownload='allow-local' disabling the default block on private/internal IPs, the cloud-metadata blocklist could be bypassed by encoding the...

CVE-2026-6267 Insertion of Sensitive Information Into Sent Data in GitLab

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 10.1.0 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Developer role to access unauthorized information due to insufficient access...

CVE-2026-14351

The CVE covers GitLab CE/EE with an exposure affecting all 8.8-era releases up to 19.0.5, 19.1 up to 19.1.3, and 19.2 up to 19.2.1. Under certain conditions, an unauthenticated user could view the title of a confidential issue via a publicly accessible merge request due to improper authorization ...

CVE-2026-16553 Insufficiently Protected Credentials in GitLab

GitLab has remediated an issue in GitLab EE affecting all versions from 18.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed some sensitive information to be disclosed to an unintended host due to improper handling of upstream requests in...

CVE-2026-16553

CVE-2026-16553 affects GitLab Enterprise Edition (GitLab EE) with remediation already issued. The issue is caused by improper handling of upstream requests in virtual registries, which under certain conditions could disclose sensitive information to an unintended host. Affected versions are 18.8–...

CVE-2026-67427 Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands $env.VAR for any host environment variable without an allowlist or capability policy check, allowing a workflow parameter to bypass the default capability polic...

CVE-2026-16328 consul-mcp-server vulnerable to server side request forgery leading to token exposure

In consul-mcp-server, versions 0.1.0 up to 0.1.3 did not restrict how the Consul backend address was supplied, allowing a connected client to override the server's configured Consul address via a request header. This may allow a malicious client to redirect the server's Consul API traffic to an...