CLSA-2026-1774225195 TuxCare security update for cli (1 CVE)

TuxCare rebuilt cli to address 1 CVE. Fixed in 0.4.3-tuxcare.1...

CLSA-2026-1773188127 TuxCare security update for jquery-ui (5 CVEs)

TuxCare rebuilt jquery-ui to address 5 CVEs. Fixed in 1.10.4-tuxcare.1...

EUVD-2026-52689

Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on TCP port 34567. Attackers can exploit...

CVE-2026-61515

Puwell IP Camera firmware versions 2.x through 4.x contains an unauthenticated command injection vulnerability that allows remote attackers to execute arbitrary operating system commands by sending a crafted JSON payload to the DebugShell interface exposed on TCP port 34567. Attackers can exploit...

CVE-2026-14337 Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting (XSS) vulnerability in a user interface component. Requires a high privileged user with a developer role.

Pega Platform versions 23.1.0 through 25.1.3 are affected by an Stored Cross-site scripting XSS vulnerability in a user interface component. Requires a high privileged user with a developer role...

MAL-2026-11910 Malicious code in @servicetitan/onboarding-ui (npm)

npm/@servicetitan/onboarding-ui is affected by the large-scale, self-propagating npm supply-chain worm of 2026-08-04 the "Shai-Hulud: Here We Go Again" wave — the same campaign that began with the compromise of the keyv and cacheable maintainer account. The listed versions were trojanized and...

perl-DBI security update

An update is available for perl-DBI. This update affects Rocky Linux 10. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list DBI is a database access Application Programming Interface API for the Perl...

perl-DBI security update

An update is available for perl-DBI. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list DBI is a database access Application Programming Interface API for the Perl...

OnionShare follows symlinks in shared directories, allowing unintended disclosure of local files

SummaryOnionShare CLI/Desktop 2.6.3 can follow symbolic links inside a selected Share or Website directory and serve the symlink target rather than limiting access to files physically contained in the selected directory. If a user shares a directory that contains attacker-supplied or otherwise...

OnionShare Receive mode writes uploaded files even when file uploads are disabled

SummaryOnionShare CLI/Desktop 2.6.3 does not enforce the Receive mode disablefiles setting at the file upload sink. When a Receive service is configured as a text-message-only endpoint --disable-files / "Disable uploading files", a remote sender who can reach the OnionShare service can still send...

PYSEC-2026-3601 Open WebUI: Arena task endpoints can bypass underlying model access controls

Summary An authenticated non-admin user with read access to an arena wrapper model can reach a restricted underlying model through task endpoints such as /api/v1/tasks/moa/completions. The normal chat route resolves arena models before the final chat dispatch and therefore re-checks the selected...

PYSEC-2026-3599 Open WebUI: Unauthenticated WebSocket Access to Collaborative Document Handlers (ydoc:awareness:update, ydoc:document:leave)

Summary The Socket.IO server is configured with alwaysconnect=True lines 78, 91 in backend/openwebui/socket/main.py and the connect handler line 329 never rejects unauthenticated connections. Two Ydoc event handlers have zero authentication checks, allowing unauthenticated clients to interact wit...

PYSEC-2026-3605 Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)

Summary Any authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a channel:-prefixed chatid and a target messageid. The channel: path routes pipeline output through...

Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)

SummaryAny authenticated user can overwrite the content of a message in a channel they do not belong to including private and DM channels by sending a chat completion request with a channel:-prefixed chatid and a target messageid. The channel: path routes pipeline output through makechannelemitte...

RHSA-2026:49612 Red Hat Security Advisory: perl-DBI security update

Bulletin has no description...

CVE-2026-14818

A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 through V5.42 Patch 1, USG FLEX series firmware versions from V4.50 through V5.42 Patch 1, USG FLEX 50W series firmware versions from V4.16 through V5.42 Patch 1,...

CVE-2026-6837

A post-authentication command injection vulnerability in the "export-cgi" CGI program in Zyxel WAX650S firmware versions through 7.10ABRM.4C0 could allow an authenticated attacker with administrator privileges to execute OS commands on an affected device...

Missing Authorization

Overview Affected versions of this package are vulnerable to Missing Authorization via the drafts endpoint in the administrative interface. An attacker can create unauthorized draft posts by sending requests with only session authentication, thereby bypassing intended role and permission checks...

PT-2026-67635

A path traversal vulnerability in the CLI command used to execute configuration files in Zyxel ATP series firmware versions from V4.32 through V5.42 Patch 1, USG FLEX series firmware versions from V4.50 through V5.42 Patch 1, USG FLEX 50W series firmware versions from V4.16 through V5.42 Patch 1,...

ROS-20260804-73-0015

The vulnerability of the ghesdoproc function in the drivers/acpi/apei/ghes.c module of the ACPI driver an extended configuration and power management interface in the Linux kernel is related to the improper disabling or release of resources. Exploiting this vulnerability can allow an attacker to...