SUSE SLED15 / SLES15 Security Update : python-pip (SUSE-SU-2026:2634-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2026:2634-1 advisory. This update for python-pip fixes the following issues - CVE-2026-3219: pip doesn't reject concatenated ZIP...

PT-2026-52799

Administrator SQL Injection in WP All Import = 4.0.1 versions...

PT-2026-52707

HTMLy 3.1.1 contains a Server-Side Request Forgery SSRF vulnerability in the RSS feed import functionality. The function get feed in system/admin/admin.php passes user-supplied $feed url directly to file get contents without any validation. An authenticated attacker with administrative privileges...

CVE-2026-57628: Improper Neutralization of Special Elements used in an SQL Command

Administrator SQL Injection in WP All Import = 4.0.1 versions...

CVE-2026-57940: Server-Side Request Forgery (SSRF)

HTMLy 3.1.1 contains a Server-Side Request Forgery SSRF vulnerability in the RSS feed import functionality. The function getfeed in system/admin/admin.php passes user-supplied $feedurl directly to filegetcontents without any validation. An authenticated attacker with administrative privileges can...

SUSE SLES16 Security Update : libcaca (SUSE-SU-2026:22175-1)

The remote SUSE Linux SLES16 / SLESSAP16 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2026:22175-1 advisory. This update for libcaca fixes the following issue - CVE-2026-42046: an integer overflow vulnerability in libcaca's canvas import...

CVE-2026-28385: Server-Side Request Forgery (SSRF)

In Canonical LXD versions 4.12 through 6.9, a Server-Side Request Forgery SSRF vulnerability in the image import functionality allows authenticated users with the cancreateimages entitlement to interact with internal network infrastructure via the /images endpoint. When importing an image from a...

PT-2026-52849

Name of the Vulnerable Software and Affected Versions Canonical LXD versions 4.12 through 6.9 Description A Server-Side Request Forgery SSRF issue exists in the image import functionality. Authenticated users possessing the can create images entitlement can interact with internal network...

📄 Penpot Server-Side Request Forgery

Penpot's remote image import let an authenticated file editor turn a normal media convenience feature into backend-origin server-side request forgery because attacker-controlled URLs crossed into a redirect-following server fetch path without destination filtering. CVE-2026-45806 Penpot's remote...

DEBIAN-CVE-2026-40941

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a package import signature validation bypass allows which allows self-signed packages. This issue has been fixed in version 1.2.31...

CVE-2026-40941

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a package import signature validation bypass allows which allows self-signed packages. This issue has been fixed in version 1.2.31...

CVE-2026-40941

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a package import signature validation bypass allows which allows self-signed packages. This issue has been fixed in version 1.2.31...

EUVD-2026-39589

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a package import signature validation bypass allows which allows self-signed packages. This issue has been fixed in version 1.2.31...

CVE-2026-40941

Cacti is an open source performance and fault management framework. Versions 1.2.30 and prior have a package import signature validation bypass allows which allows self-signed packages. This issue has been fixed in version 1.2.31...

GO-2026-5755 Canonical MicroCeph: path traversal issue in the remote-import AP in github.com/canonical/microceph/microceph

Canonical MicroCeph: path traversal issue in the remote-import AP in github.com/canonical/microceph/microceph...

GO-2026-5724 Gogs has the ability to import local repositories via Mirror Settings in gogs.io/gogs

Gogs has the ability to import local repositories via Mirror Settings in gogs.io/gogs. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanner...

GO-2026-5582 Vikunja has File Size Limit Bypass via Vikunja Import in code.vikunja.io/api

Vikunja has File Size Limit Bypass via Vikunja Import in code.vikunja.io/api. NOTE: The source advisory for this report contains additional versions that could not be automatically mapped to standard Go module versions. If this is causing false-positive reports from vulnerability scanners, please...

GO-2026-5612 Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus

Incus has a Nil-Pointer Dereference via Custom Volume Import in github.com/lxc/incus...

GO-2026-5384 Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus

Incus has Nil-Pointer Dereference via S3 Bucket Import in github.com/lxc/incus...

GO-2026-5280 Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus

Incus is affected by unbounded binary import disk exhaustion in github.com/lxc/incus...