CVE-2026-77950 RPC error handler fails open in AshTypescript, disclosing unredacted errors

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match. applyerrorhandler/3 in...

CVE-2026-77950 RPC error handler fails open in AshTypescript, disclosing unredacted errors

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match. applyerrorhandler/3 in...

CVE-2026-77950

ash_typescript (versions 0.8.0 through before 0.18.0) contains a fail-open flaw in its RPC error handling. The apply_error_handler/3 function in lib/ash_typescript/rpc/errors.ex is the sole hook for redacting or suppressing errors before they reach the client. Because error handlers are conventio...

EEF-CVE-2026-77950 RPC error handler fails open in AshTypescript, disclosing unredacted errors

Summary Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match. applyerrorhandler/3 in...

EUVD-2026-68925

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match. applyerrorhandler/3 in...

CVE-2026-77950 RPC error handler fails open in AshTypescript, disclosing unredacted errors

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ashtypescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match. applyerrorhandler/3 in...

CVE-2026-84115: Improper Privilege Management

A vulnerability was found in Cleo Harmony up to 5.8.1.10. The affected element is an unknown function of the file /api/connections of the component JWT Refresh Token Handler. Performing a manipulation of the argument Bearer results in improper privilege management. The attack is possible to be...

PT-2026-84507

Name of the Vulnerable Software and Affected Versions SVGO versions 1.0.0 through 2.8.3 SVGO versions 3.0.0 through 3.3.4 SVGO versions 4.0.0 through 4.0.9 Description The removeScripts plugin known as removeScriptElement in versions 2 and 3, implemented in plugins/removeScripts.js, fails to...

Linux Distros Unpatched Vulnerability : CVE-2026-83605

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and ...

CVE-2026-71981: Deserialization of Untrusted Data

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the backquery GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payload...

PT-2026-84504

Name of the Vulnerable Software and Affected Versions Scrapy versions prior to 2.17.0 Description The S3DownloadHandler in scrapy/core/downloader/handlers/s3.py converts S3-scheme bucket and key requests into plaintext HTTP requests unless the is secure variable in request.meta is explicitly...

Linux Distros Unpatched Vulnerability : CVE-2026-82556

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A vulnerability was found in Forgejo up to 15.0.4. This issue affects the function net.LookupIP of the file services/migrations/allowlist/ismigrateallowed.go of...

PT-2026-84077

Generation of Error Message Containing Sensitive Information vulnerability in ash-project ash typescript allows an unauthenticated attacker to receive unredacted internal error data by provoking an error shape the configured error handler does not match. apply error handler/3 in lib/ash...

PT-2026-84465

Cypht before 2.12.2 contains a PHP object injection vulnerability that allows authenticated attackers to execute arbitrary operating system commands by supplying a crafted PHP object graph in the back query GET parameter of the logout handler. Attackers can pass a base64-encoded serialized payloa...

wget security, bug fix, and enhancement update

1.21.1-11 - Resolves: RHEL-220497 - async unsafe code in signal handler context 1.21.1-10 - Fix CVE-2026-58471: buffer overflow in convertfname - Resolves: RHEL-194521 1.21.1-9 - Resolves: RHEL-210636 - Fix integer+buffer overflow in htmlquotestring...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the chunk upload handler process. An attacker can consume excessive server storage by uploading multiple large incomplete file chunks without proper permissions, potentially leading to denial of service for...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the media handler process. An attacker can access files outside the intended directory and detect the presence of .json files by supplying specially crafted paths containing encoded slashes in requests. This is...

Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling

TL;DR This vulnerability affects all Kirby sites that are deployed to a server that allows requests for URLs with encoded slashes %2f, such as nginx, PHP's built-in server or Apache setups that have the option AllowEncodedSlashes enabled. It was possible to create and access thumbnails from media...

GHSA-9VX2-J98C-P72W Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling

TL;DR This vulnerability affects all Kirby sites that are deployed to a server that allows requests for URLs with encoded slashes %2f, such as nginx, PHP's built-in server or Apache setups that have the option AllowEncodedSlashes enabled. It was possible to create and access thumbnails from media...

[SECURITY] [DLA 4765-1] expat security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4765-1 [email protected] https://www.debian.org/lts/security/ Andrej Shadura August 31, 2026 https://wiki.debian.org/LTS -...