fence-agents security update

An update is available for fence-agents. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The fence-agents packages provide a collection of scripts for handling...

RLSA-2026:98612 Critical: fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fixes: pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance...

RLSA-2026:98503 Critical: fence-agents security update

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster. Security Fixes: pyjwt: pyjwt: Authentication bypass via empty HMAC key acceptance...

fence-agents security update

An update is available for fence-agents. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list The fence-agents packages provide a collection of scripts for handling...

CVE-2026-128049

OpenMage Magento LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in the admin and storefront OAuth confirm and confirmSimple actions, which accept GET requests without form-key validation. Attackers holding OAuth consumer credentials can...

CVE-2026-128043

OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in PayPal cancel and decline return handlers that trust only the checkout session without verifying the request came from PayPal. Attackers can lure a shopper into a...

CVE-2026-75489 Cudy TR3000 before 2.5.42 SMT Message Forgery via Probe Request Vendor IE

Cudy TR3000 before 2.5.42 contains an insufficient verification of data authenticity vulnerability in the mtwifi Smart Mesh Technology SMT onboarding, which protects messages only with an AES-CBC key derived from public values and a CRC32 check. Adjacent unauthenticated attackers can forge SMT...

CVE-2026-75489

The Cudy TR3000 (versions before 2.5.42 ) is vulnerable to an insufficient verification of data authenticity in the mt_wifi Smart Mesh Technology (SMT) onboarding process. The system improperly protects messages using an AES-CBC key derived from public values combined with a CRC32 check . This al...

EUVD-2026-125237

NocoDB from 2026.05.2 before 2026.07.0 contains a server-side request forgery vulnerability that allows Editor-role users to fetch internal URLs because data import reused the webhook internal-network exemption. When NCALLOWLOCALHOOKS or NCWEBHOOKALLOWPRIVATENETWORK is set, attackers can request...

EUVD-2026-125197

Vvveb through 1.0.8.6 contains a cross-site request forgery vulnerability that allows attackers to perform admin state-changing actions because checkCsrf in admin/controller/base.php only validates tokens for POST requests. Attackers can lure a logged-in admin into loading a forged cross-site GET...

CVE-2026-126377

The Vvveb software (versions before 1.0.9.0 ) is susceptible to an authentication bypass vulnerability within the generateCookie() function in system/user/user.php. The root cause is the use of loose comparison to validate MD5 cookie hashes, which is exploitable via PHP Type Juggling . An unauthe...

EUVD-2026-125172

SiYuan before 3.8.10 contains a server-side request forgery vulnerability in the skill-install download path because fetchBytes performs only a parse-time hostname check instead of using ssrfSafeClient. Attackers can supply a skill URL via the MCP skill install action that redirects or DNS-rebind...

EUVD-2026-124960

OpenEMR before 8.5.0 contains a server-side request forgery vulnerability in PatientPortalPDFDocumentCreator::createPdfObject that allows authenticated patients to make the server issue HTTP GET requests. Attackers can submit img src, inline style url, or reinserted unpurified style blocks via th...

EUVD-2026-124939

OpenEMR before 8.5.0 contains a cross-site request forgery vulnerability in ObservationController::deleteAction that allows attackers to delete observation form records without a CSRF token. Attackers can lure a logged-in clinician to a page issuing a GET to delete.php with guessed id values,...

EUVD-2026-125090

Rustrak before 0.26.0 contains a server-side request forgery vulnerability that allows users with integrations update permission to send requests to arbitrary destinations by supplying routingoverride.url to POST /api/integrations/id/test. Attackers can target loopback, private-network and cloud...

EUVD-2026-125065

OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in PayPal cancel and decline return handlers that trust only the checkout session without verifying the request came from PayPal. Attackers can lure a shopper into a...

EUVD-2026-125059

OpenMage Magento LTS before 20.18.2 and 21.0.0-beta1 before 21.0.0-beta3 contains a cross-site request forgery vulnerability in the admin and storefront OAuth confirm and confirmSimple actions, which accept GET requests without form-key validation. Attackers holding OAuth consumer credentials can...

cve-2026-61732-lab

CVE-2026-61732 — Decepticon ChatML role-boundary forgery lab A self-contained, disposable lab that reproduces GHSA-g5f9-3xfg-p9mf / CVE-2026-61732: Decepticon , an autonomous red-team agent, wrapped web-crawl output into LLM messages without neutralizing ChatML special-token literals. On a...

rwsploit

Oracle Reports rwservlet Scanner ⚠️ For authorized use only. Only run this tool against systems you own or have explicit written permission to test. Unauthorized use is illegal. A focused exploitation scanner for Oracle Reports Server rwservlet targeting CVE-2012-3152 and CVE-2012-3153 — affecting...

SASTRA-ADI-WIGUNA-CVE-2026-21858-Holistic-Audit

= doi.org/10.5281/zenodo.18278825 = orcid.org/0009-0007-7728-256X RECONSTRUCTIONANALYSIS CVE-2026-21858: Ni8mare - n8n RCE Full Chain Exploit 1. Executive Summary & Overview This document presents a deterministic technical reconstruction analysis of the CVE-2026-21858 vulnerability, internally...