137127 matches found
EUVD-2026-42395
Plate: Media embed provider metadata can bypass URL sanitization and execute iframe JavaScript...
CVE-2026-79774
Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\Twig\SecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sandbox restrictions. Attackers can exploit method forwarding through Eloquent...
CVE-2026-79775
rclone versions = v1.72.0 and = v1.74.4 fixed in v1.75.0 contain multiple denial-of-service vulnerabilities in the archive backend's SquashFS parser, which relies on the github.com/diskfs/go-diskfs dependency. The parser fails to validate attacker-controlled superblock and metadata values before...
CVE-2026-13217 NULL-pointer dereference in Zephyr OCPP CALLRESULT parsing via unchecked strtok_r/atoi
The OCPP 1.6 client in subsys/net/lib/ocpp/ocpp.c reconstructs a session handle and PDU id from the uid field of a CALLRESULT message. In ocppprocessservermsg the code calls atoistrtokruid, "-", &tmp without checking the strtokr return value. When the server-supplied uid is empty or contains no -...
CLSA-2026-1787673713 TuxCare security update for org.springframework.boot (1 CVE)
TuxCare rebuilt 77 org.springframework.boot packages to address 1 CVE. Fixed in 2.4.6-tuxcare.10...
CLSA-2026-1787671361 TuxCare security update for org.springframework.boot (1 CVE)
TuxCare rebuilt 78 org.springframework.boot packages to address 1 CVE. Fixed in 3.1.8-tuxcare.9...
EUVD-2026-65532
Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\Twig\SecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sandbox restrictions. Attackers can exploit method forwarding through Eloquent...
CVE-2026-79774 Winter CMS before 1.2.13 Twig Sandbox Escape via SecurityPolicy
Winter CMS versions before 1.2.13 contain an incomplete fix for a Twig sandbox escape vulnerability in System\Twig\SecurityPolicy that allows authenticated backend users with template-editing permissions to bypass sandbox restrictions. Attackers can exploit method forwarding through Eloquent...
CVE-2026-55539
PraisonAI, a multi-agent teams system, exposed its async Jobs API (/api/v1/runs) without authentication prior to version 4.6.51. The create_app function mounted the endpoint with no access control, allowing any reachable caller to submit jobs, read results, cancel runs, or delete jobs using opera...
EUVD-2026-53582
praisonaiagents has a webcrawl SSRF protection bypass via unchecked redirect targets...
CLSA-2026-1787667194 TuxCare security update for org.jsoup:jsoup (1 CVE)
TuxCare rebuilt org.jsoup:jsoup to address 1 CVE. Fixed in 1.17.2-tuxcare.1...
ROOT-OS-DEBIAN-12-CVE-2026-5704 CVE-2026-5704 in tar - Patched by Root
Root has patched CVE-2026-5704 in the tar package for Root:Debian:12. Multiple fixed versions available...
praisonaiagents web_crawl vulnerable to SSRF via redirect-following
Summary webcrawl an exported, model-callable tool validates only the INITIAL URL's resolved IP against a private/loopback blocklist, then fetches with httpx.Clientfollowredirects=True and never re-validates redirect targets. An attacker who controls the agent's crawl target a malicious task, or...
GHSA-5R34-2G38-6569 praisonaiagents web_crawl vulnerable to SSRF via redirect-following
Summary webcrawl an exported, model-callable tool validates only the INITIAL URL's resolved IP against a private/loopback blocklist, then fetches with httpx.Clientfollowredirects=True and never re-validates redirect targets. An attacker who controls the agent's crawl target a malicious task, or...
CLSA-2026-1787663318 TuxCare security update for follow-redirects (1 CVE)
TuxCare rebuilt follow-redirects to address 1 CVE. Fixed in 0.0.3-tuxcare.3...
CLSA-2026-1787661459 TuxCare security update for org.springframework.security (1 CVE)
TuxCare rebuilt 21 org.springframework.security packages to address 1 CVE. Fixed in 5.7.12-tuxcare.8...
ROOT-OS-DEBIAN-12-CVE-2026-34873 CVE-2026-34873 in mbedtls - Patched by Root
Root has patched CVE-2026-34873 in the mbedtls package for Root:Debian:12. Multiple fixed versions available...
Moderate: Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update
An update for Red Hat Hardened Images RPMs is now available. This update includes the following RPMs: qt6-qtbase: qt6-qtbase-6.11.2-2.hum1 aarch64, x8664 qt6-qtbase-common-6.11.2-2.hum1 noarch qt6-qtbase-devel-6.11.2-2.hum1 aarch64, x8664 qt6-qtbase-examples-6.11.2-2.hum1 aarch64, x8664...