PT-2026-95747

Name of the Vulnerable Software and Affected Versions Save as PDF Plugin by PDFCrowd versions prior to 4.6.2 Description The plugin is susceptible to Arbitrary Function Invocation. The eval shortcode function copies shortcode attributes into a custom options array without sanitization or capabili...

CVE-2026-93765: Use of Externally-Controlled Input to Select Classes or Code

Mongoid contains an unsafe reflection weakness in the document persistence layer of its object-document mapping code. Input whose keys are passed through from an unauthenticated party by an embedding application can cause unintended internal method invocation instead of the intended array field...

Linux Distros Unpatched Vulnerability : CVE-2026-90235

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - sunrpc: xprtsock: annotate shared socket callbacks with READONCE/WRITEONCE xprtsock replaces and restores sk-skdataready and sk-skwritespace on live sockets wit...

Security Bulletin: IBM Db2 Developer Extension is affected by vulnerability in Spring Expression (CVE-2026-41850, CVE-2026-41851,CVE-2026-41852 )

Summary IBM Db2 Developer Extension is affected by vulnerability in Spring Expression CVE-2026-41850, CVE-2026-41851,CVE-2026-41852 Vulnerability Details CVEID:CVE-2026-41850 DESCRIPTION: Applications that evaluate user-supplied Spring Expression Language SpEL expressions are vulnerable to an...

EUVD-2026-82327

mport is the MidnightBSD Package Manager. Prior to 2.7.8, privileged package fetch and cache-cleaning operations used race-prone path handling across libmport/fetch.c, libmport/clean.c, libmport/util.c, libmport/bundlereadinstallpkg.c, libmport/deleteprimative.c, and...

CVE-2026-54575 mport package fetch and clean paths are vulnerable to TOCTOU filesystem races

mport is the MidnightBSD Package Manager. Prior to 2.7.8, privileged package fetch and cache-cleaning operations used race-prone path handling across libmport/fetch.c, libmport/clean.c, libmport/util.c, libmport/bundlereadinstallpkg.c, libmport/deleteprimative.c, and...

CVE-2026-90235 sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE

In the Linux kernel, the following vulnerability has been resolved: sunrpc: xprtsock: annotate shared socket callbacks with READONCE/WRITEONCE xprtsock replaces and restores sk-skdataready and sk-skwritespace on live sockets with plain stores, and xsudpdosetbuffersize invokes sk-skwritespace via ...

CVE-2026-92949

A flaw was found in vm2, a JavaScript sandbox. This vulnerability allows sandboxed scripts to bypass security protections, specifically vm.freeze and vm.readonly, which are designed to prevent unauthorized modifications to objects. An attacker can exploit this by directly accessing and invoking...

PT-2026-94248

A flaw was found in the foreman remote execution plugin's template invocations controller. The show template invocation by host action resolves the job invocation by ID without evaluating the caller's view job invocations permission filter against the record. An authenticated user whose job...

CVE-2026-61590

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's observability endpoints expose live view/session state and a remote method-invocation surface evalhandler. The localhost restriction was an opt-in...

CVE-2026-61590 djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's observability endpoints expose live view/session state and a remote method-invocation surface evalhandler. The localhost restriction was an opt-in...

EUVD-2026-80744

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's observability endpoints expose live view/session state and a remote method-invocation surface evalhandler. The localhost restriction was an opt-in...

CVE-2026-61590

djust is a library providing Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7 , its observability endpoints exposed live view/session state and a remote method-invocation surface (eval_handler). The root cause is that the local...

CVE-2026-61590 djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's observability endpoints expose live view/session state and a remote method-invocation surface evalhandler. The localhost restriction was an opt-in...

GHSA-8G2F-G3GQ-5RJV djust's observability endpoints are network-exposed: the localhost gate is an opt-in middleware the docs omit, and the views enforce only DEBUG

Impact djust's observability endpoints expose live view/session state and a remote method-invocation surface evalhandler. The localhost restriction was an opt-in middleware that the documented setup omits; the views themselves enforced only DEBUG. In the misconfigured-but-documented scenario DEBU...

CVE-2026-76551

The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution...

EUVD-2026-80176

The WP Import Export Lite WordPress plugin before 3.9.33 does not restrict which PHP function may be applied to exported field values, allowing users granted its export permission to have arbitrary functions invoked on values they control, leading to remote code execution...

PT-2026-93886

Impact djust's observability endpoints expose live view/session state and a remote method-invocation surface eval handler. The localhost restriction was an opt-in middleware that the documented setup omits; the views themselves enforced only DEBUG. In the misconfigured-but-documented scenario DEB...

PT-2026-93746

Name of the Vulnerable Software and Affected Versions djust versions prior to 1.0.7 Description Observability endpoints expose live view/session state and a remote method-invocation surface via the eval handler function. In configurations where DEBUG is enabled and the optional localhost...

CVE-2026-61590: Missing Authentication for Critical Function

djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's observability endpoints expose live view/session state and a remote method-invocation surface evalhandler. The localhost restriction was an opt-in...