Important: grafana security, bug fix, and enhancement update

Grafana is an open source, feature rich metrics dashboard and graph editor for Graphite, InfluxDB & OpenTSDB. Security Fixes: github.com/go-git/go-billy: Billy: Denial of Service via crafted input due to insufficient validation CVE-2026-44740 Bug Fixes and Enhancements: grafana / almalinux-8.10.z...

PT-2026-65357

Gitea: Public-only API token restriction is not enforced on team API routes in gitea.dev...

PT-2026-65362

Gitea: Null Pointer Dereference in AddTime API Causes Authenticated Denial of Service in gitea.dev...

PT-2026-65378

Gitea: Fork Synchronization Continues After Parent Repository Changes from Public to Private in code.gitea.io/gitea...

PT-2026-65356

Gitea: Repository migration SSRF via multi-answer DNS allow-list bypass in gitea.dev...

PT-2026-65374

Gitea: Unauthenticated ReDoS via CODEOWNERS pattern matching allows denial of service in code.gitea.io/gitea...

Xalgorix Autonomous AI Pentesting Agent 4.5.87

Most scanners detect. Xalgorix proves. An autonomous LLM agent works a full pentest methodology, then an independent verifier re-exploits every finding before it's reported - so you get proof, not a pile of maybes to triage. Self-hosted, private, and bring-your-own-LLM. Built in Go + TypeScript...

PT-2026-64902

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the Geo Location...

PT-2026-64903

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the backup restore...

PT-2026-64901

An OS Command Injection vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, and MOVEit WAF allows an authenticated attacker with high privileges to execute arbitrary operating system commands on the affected appliance via the management interfac...

PT-2026-65353

Excelize: Unbounded Row Index Allocation in Worksheet Parser checkSheet OOM/Panic DoS in github.com/xuri/excelize...

PT-2026-65368

Gitea: draft release attachment disclosure via missing web authorization in gitea.dev...

PT-2026-65376

Gitea: OAuth token introspection returns metadata of tokens issued to other clients RFC 7662 section 4 violation in gitea.dev...

PT-2026-65381

Gitea: SSRF in restore-repo via unsanitized pull request.yml Head.CloneURL in gitea.dev...

PT-2026-65348

The Avro map decoder accepts attacker-controlled block-element counts from the wire format and grows the destination map without enforcing an upper bound. A producer can declare an arbitrarily large map in one block, or chunked across many sub-limit blocks and exhaust process memory until the OOM...

PT-2026-65372

Gitea: SSRF via HTTP Redirect in Repository Migration in code.gitea.io/gitea...

PT-2026-65382

Gitea: Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access in gitea.dev...

PT-2026-65367

Gitea: GHSA-8fwc-qjw5-rvgp ClearRepoWatches fix not applied to API EditRepo path — sister code path retains stale watches on public-private in gitea.dev...

PT-2026-65355

Improper parsing of W3C baggage headers may lead to DoS in github.com/DataDog/dd-trace-go...

PT-2026-65352

Providing a specially crafted dictionary to s2.NewDict and using it to encode data can make the encoder read out of bounds...