CVE-2026-93983

OpenPanel through 2.3.0 fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can supply crafted filter names to bypass project isolation and access metrics from other projects...

EUVD-2026-83588

OpenPanel through commit bad75bdd fails to escape property keys in ClickHouse SQL queries, allowing authenticated users to inject boolean SQL terms. Attackers can supply crafted filter names to bypass project isolation and access metrics from other projects...

CVE-2026-93983

OpenPanel (through commit bad75bdd ) contains a SQL injection vulnerability in its ClickHouse query layer. The root cause is a failure to escape property keys used in ClickHouse SQL queries, allowing an authenticated user to inject boolean SQL terms via crafted filter names. This enables attacker...

[slackware-security] stunnel

New stunnel packages are available for Slackware 15.0 and -current to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: patches/packages/stunnel-5.82-i586-1slack15.0.txz: Upgraded. This update fixes security issues: Fixed truncation and out-of-bounds reads when inheriti...

CVE-2026-61670 microsandbox: Secret values exposed in world-readable process arguments

microsandbox is an easy, fast, local-first microVM runtime and library. Prior to 0.5.10, sdk/rust/lib/runtime/spawn.rs serializes NetworkConfig secret values into the --network-config argument and passes per-sandbox secrets through repeated --env arguments accepted by crates/cli/lib/sandboxcmd.rs...

CVE-2026-77170

The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs without validating whether the user owns or has permission to manage the referenced board...

PT-2026-95491

Name of the Vulnerable Software and Affected Versions btrbk versions 0.29.0 through 0.32.6 Description The ssh filter btrbk.sh script constructs allow stream match using a start anchor but lacks an end-of-string anchor for the complete command. This allows a user restricted by an authorized keys...

PT-2026-95210

Name of the Vulnerable Software and Affected Versions Deck affected versions not specified Description The Deck config API allows authenticated users to set board-scoped configuration keys for arbitrary board IDs. This occurs because the system fails to validate whether the user owns or has the...

PT-2026-95273

Name of the Vulnerable Software and Affected Versions GPTranslate – Multilingual AI Translation Agent for WordPress versions prior to 2.34.7 Description Sensitive information exposure occurs via the enqueue frontend scripts function. Unauthenticated attackers can extract plaintext third-party AI...

PT-2026-95706

Name of the Vulnerable Software and Affected Versions microsandbox versions prior to 0.5.10 Description The software serializes NetworkConfig secret values into the --network-config argument and passes per-sandbox secrets through repeated --env arguments within sdk/rust/lib/runtime/spawn.rs and...

EulerOS 2.0 SP10 : python-jwt (EulerOS-SA-2026-3761)

According to the versions of the python-jwt packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : PyJWT is a JSON Web Token implementation in Python. Prior to 2.12.0, PyJWT does not validate the crit Critical Header Parameter defined in RFC...

JFrog Artifactory 7.161.x < 7.161.16 Multiple Vulnerabilities

According to its self-reported version number, the version of JFrog Artifactory installed on the remote host is 7.161.x prior to 7.161.16. It is, therefore, affected by the following vulnerabilities. - An authentication weakness that, under default configuration, may allow an unauthenticated...

EUVD-2026-82401

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an ImportedClusterSecrets resource containing the cluster's complete CA secrets bundle. The access rules in...

CVE-2026-45726 Omni: Reader-level users can retrieve imported cluster CA keys via ResourceService

Omni manages Kubernetes on bare metal, virtual machines, or in a cloud. From 1.3.0 until 1.6.6 and 1.7.3, importing a standalone Talos cluster creates an ImportedClusterSecrets resource containing the cluster's complete CA secrets bundle. The access rules in...

CVE-2026-92758 Logs may collect sensitive information

If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information if in use such as passwords and AWS secure access keys...

CVE-2026-92758

This MongoDB -related vulnerability occurs when the application logging mode is set to DEBUG or a malformed MongoDB connection string is used, causing application logs to capture sensitive information such as passwords and AWS secure access keys. The root cause is overly verbose or misconfigured ...

CVE-2026-92758 Logs may collect sensitive information

If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information if in use such as passwords and AWS secure access keys...

CVE-2026-92758 Logs may collect sensitive information

If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information if in use such as passwords and AWS secure access keys...

Logs may collect sensitive information

If logging mode is set to DEBUG or a malformed MongoDB connection string is used, application logs may collect sensitive information if in use such as passwords and AWS secure access keys...

EUVD-2026-82214

In the Linux kernel, the following vulnerability has been resolved: crashdump: release keyring reference at the correct time restoredmcryptkeystothreadkeyring gets a reference to the user keyring before restoring the saved dm-crypt keys. The same keyring reference is then passed to addkeytokeyrin...