CVE-2026-58439

A flaw was found in Gitea. This vulnerability allows an attacker to bypass branch protection by retargeting a Pull Request PR that has a stale 'official' approval flag. This could lead to unauthorized code being merged into a protected branch, compromising code integrity. Mitigation Mitigation fo...

PT-2026-79053

Name of the Vulnerable Software and Affected Versions Banks versions prior to 2.4.5 Description The DirectoryPromptRegistry.set function in src/banks/registries/directory.py fails to perform canonicalization or containment validation when interpolating Prompt.name and Prompt.version values into a...

PT-2026-79080

Name of the Vulnerable Software and Affected Versions Mongoose versions prior to 7.22 Description A remote unauthenticated attacker can exploit an HTTP/1.0 reverse-proxy deployment by sending a request with Transfer-Encoding: chunked and conflicting framing. The http cb function in src/http.c...

PT-2026-81885

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.24 Apache Tomcat versions 10.1.0-M1 through 10.1.57 Apache Tomcat versions 9.0.0.M1 through 9.0.120 Apache Tomcat versions 8.5.0 through 8.5.100 Description An off-by-one error in the rewrite valve...

CVE-2026-76241

stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into an environment where plugin directories are writable by less-trusted users, unsigned potentially malicious plugin code...

CVE-2026-76241 stigmem Plugin Signature Enforcement Bypass via Configuration

stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into an environment where plugin directories are writable by less-trusted users, unsigned potentially malicious plugin code...

EUVD-2026-62405

stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into an environment where plugin directories are writable by less-trusted users, unsigned potentially malicious plugin code...

CVE-2026-76241 stigmem Plugin Signature Enforcement Bypass via Configuration

stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into an environment where plugin directories are writable by less-trusted users, unsigned potentially malicious plugin code...

CVE-2026-76241

stigmem-node 0.9.0a1 lets an operator disable plugin signature enforcement via a single configuration flag without confirmation. If plugin directories are writable by less-trusted users, unsigned malicious plugins can be loaded, causing arbitrary code execution. Upgrade to 0.9.0a2, which requires...

CVE-2026-49431 Incorrect user validation in ZFS_IOC_SET_PROP ioctl

The ZFSIOCSETPROP ioctl, used by zfs-set8, incorrectly validated the calling user such that an unprivileged user is able to set metadata on a dataset indicating that the dataset has received properties from a zfs-recv8 stream. Any local user can set the internal ZFS metadata flag "$hasrecvd" on...

FreeBSD : podman -- podman quadlet install --replace does not fully replace the old file (01c15468-9b7b-11f1-a75c-589cfc10a551)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the 01c15468-9b7b-11f1-a75c-589cfc10a551 advisory. The Podman developers report: When running podman quadlet install --replace to replace a Quadlet file, ...

CVE-2026-76241: Download of Code Without Integrity Check

stigmem-node 0.9.0a1 allows plugin signature enforcement to be disabled via a single configuration flag without a second explicit acknowledgment. If that setting is carried into an environment where plugin directories are writable by less-trusted users, unsigned potentially malicious plugin code...

CVE-2026-57826

An issue was discovered in openHiTLS 0.2.0 through 0.3.2. In the X.509 certificate chain verification, the basic constraints extension and CA flag processing of intermediate CAs are only verified for v3 certificates, and v1/v2 certificates are ignored...

GO-2026-6191 Arbitrary file write via --links symlinks in github.com/rclone/rclone

Arbitrary file write via --links symlinks in github.com/rclone/rclone...

CVE-2026-70657 Copyparty: file/dirkey confusion

Copyparty is a portable file server. Prior to 1.20.17, copyparty volumes with the dk or dks directory-key flag combined with the fk or fka file-key flag can convert a valid file key into a directory key, granting read access to the containing folder. This vulnerability was only reachable if both...

SUSE-SU-2026:23211-1 Security update for suseconnect-ng

This update for suseconnect-ng fixes the following issue: - Build against outdated go1.24-openssl bsc1268900. Changes for suseconnect-ng: - Update version to 1.23.0: - Use product identifier for product migrations bsc1268596. - Switch to using go1.26-openssl as the default Go version to install t...

CVE-2026-75835 Grav API Plugin before 1.0.14 Missing Authorization

Grav API plugin getgrav/grav-plugin-api before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize AbstractApiController.php. The function fails to consult the calling request's API key scopes, relying instead on the account's raw super-admin flag and ACL grants. As a...

CVE-2026-75835

Grav API plugin getgrav/grav-plugin-api before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize AbstractApiController.php. The function fails to consult the calling request's API key scopes, relying instead on the account's raw super-admin flag and ACL grants. As a...

tomcat: Apache Tomcat: Access control bypass due to off-by-one error in RewriteValve [N] flag processing

A flaw was found in Apache Tomcat. An off-by-one error in the RewriteValve's N flag processing causes rewrite rules to restart at the second rule instead of the first. This vulnerability may allow an attacker to bypass intended access controls...

SUSE CVE-2026-19487

Perl versions from 5.9.4 before 5.41.9 produce incorrect regular expression match results when a stale failure flag ends the Aho-Corasick prescan early in Sfindbyclass. The prescan walks the subject for positions where the full pattern could match, and the engine tries it from the leftmost one...