CVE-2026-12894 Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values ReflectionValueResolver, which fails to properly block access to sensitive Java internal functions...

CVE-2026-12894

The Qute template engine in Quarkus is vulnerable to server-side template injection (SSTI) via the ReflectionValueResolver component, which fails to properly block access to sensitive Java internal functions when processing certain data types like Enums. An attacker who can provide or influence t...

CVE-2026-12894 Io.quarkus:quarkus-qute: quarkus-qute:server-side template injection (ssti) vulnerability in reflectionvalueresolver of the quarkus qute template engine

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values ReflectionValueResolver, which fails to properly block access to sensitive Java internal functions...

EUVD-2026-68505

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values ReflectionValueResolver, which fails to properly block access to sensitive Java internal functions...

CVE-2026-6464

A flaw was found in PostgreSQL psql. During the COPY FROM STDIN operation, untrusted data can be mistakenly interpreted as psql commands if an error injection causes the command to fail prematurely. This could allow an attacker to achieve arbitrary command execution. Successful exploitation...

php security, bug fix, and enhancement update

An update is available for php. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list PHP is an HTML-embedded scripting language commonly used with the Apache HTTP...

RLSA-2026:61259 Low: php security, bug fix, and enhancement update

PHP is an HTML-embedded scripting language commonly used with the Apache HTTP Server. Security Fixes: php: ext/openssl: memory corruption in opensslencrypt with AES-WRAP-PAD CVE-2026-14355 php: ext-pgsql: PHP: SQL injection via improper backslash escaping CVE-2026-17543 php: PHP: Denial of Servic...

CVE-2026-82692

D-Link DNS-340L and DNS-345 (versions up to 20260717 ) are vulnerable to an OS command injection in the CGI script /cgi-bin/iscsi_mgr.cgi . By manipulating the arguments alias , username , password , or volume_location , an attacker can inject and execute arbitrary OS commands. The attack can be ...

CVE-2026-82692 D-Link DNS-340L/DNS-345 iscsi_mgr.cgi os command injection

A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsimgr.cgi. Performing a manipulation of the argument alias/username/password/volumelocation results in os command injection. It is possible to initiate the attack remotely...

EUVD-2026-68503

A vulnerability was found in D-Link DNS-340L and DNS-345 up to 20260717. This affects an unknown part of the file /cgi-bin/iscsimgr.cgi. Performing a manipulation of the argument alias/username/password/volumelocation results in os command injection. It is possible to initiate the attack remotely...

USN-8699-1 libssh vulnerabilities

It was discovered that libssh had a stack buffer overflow in its SFTP server when constructing directory listing entries for long filenames. An attacker could possibly use this issue to cause libssh to crash or execute arbitrary code. This issue only affected Ubuntu 26.04 LTS. CVE-2026-15370 It w...

EUVD-2026-68490

Improper neutralization of input during web page generation in Apache Wicket. org.apache.wicket.markup.head.MetaDataHeaderItem generates and header tags. It escaped the attribute names it wrote, but ran the attribute values through a replacement of " with ". A backslash before a double quote mean...

CVE-2026-12894

A flaw was found in the Qute template engine, which is used by Quarkus to generate dynamic content like HTML pages or emails. The issue exists in the component responsible for looking up data values ReflectionValueResolver, which fails to properly block access to sensitive Java internal functions...

EUVD-2026-68485

A vulnerability has been found in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected by this issue is some unknown functionality of the file /cgi-bin/usbdevice.cgi of the component CGI Handler. Such manipulation of the argument fupsip leads to os command injection. The attac...

CVE-2026-82691 D-Link DNS-320L/DNS-327L/DNS-340L/DNS-345 CGI usb_device.cgi os command injection

A vulnerability has been found in D-Link DNS-320L, DNS-327L, DNS-340L and DNS-345 up to 20260717. Affected by this issue is some unknown functionality of the file /cgi-bin/usbdevice.cgi of the component CGI Handler. Such manipulation of the argument fupsip leads to os command injection. The attac...

CVE-2026-82691

A remote OS command injection vulnerability affects D-Link DNS-320L, DNS-327L, DNS-340L, and DNS-345 through firmware version 20260717 . The flaw resides in the CGI Handler file /cgi-bin/usb_device.cgi, where unsanitized input to the f_ups_ip argument allows an attacker to inject arbitrary OS com...

CVE-2026-42588

A flaw was found in Apache ActiveMQ. An authenticated attacker can exploit an improper input validation vulnerability in the Jolokia JMX-HTTP bridge. By crafting a malicious discovery URI, the attacker can trigger the VM transport's brokerConfig parameter to load a Spring XML application context...

EUVD-2026-68483

A flaw has been found in D-Link DNS-327L and DNS-340L up to 20260717. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/vemgr.cgi. This manipulation of the argument fdev causes os command injection. The attack is possible to be carried out remotely. The exploit has...

CVE-2026-82690 D-Link DNS-327L/DNS-340L ve_mgr.cgi os command injection

A flaw has been found in D-Link DNS-327L and DNS-340L up to 20260717. Affected by this vulnerability is an unknown functionality of the file /cgi-bin/vemgr.cgi. This manipulation of the argument fdev causes os command injection. The attack is possible to be carried out remotely. The exploit has...

CVE-2026-82690

CVE-2026-82690 is an OS command injection in D-Link DNS-327L and DNS-340L (firmware up to 20260717 ). The flaw resides in the /cgi-bin/ve_mgr.cgi endpoint, where manipulation of the f_dev argument allows remote command execution. The attack is remotely exploitable and requires high privileges (sc...