CVE-2026-77770 miniOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator

The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site options whose names come from unauthenticated request input, allowing any visitor to delete arbitrary options, which can lock every...

CVE-2026-88265: Improper Link Resolution Before File Access

A flaw was found in crun. After pivotroot, reopening /dev/null for stdio can follow a symlink and attach a host file to container stdio, then change that file's ownership. Affected versions are crun 1.29.1 and earlier. Default configurations that mount a fresh /dev are not exposed. No fixed relea...

PT-2026-89595

A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese market, that could allow operating system commands to be executed if a local user opens a specially crafted link that is handled by the application...

PT-2026-89393

Renovate is a dependency update automation tool. In versions before 44.11.2 and Mend Renovate CE/EE images and charts before 15.4.0, and mend-renovate-enterprise-edition helm chart before 10.4.0, when listing new package versions from a NuGet registry Renovate follows pagination URLs supplied by...

PT-2026-89398

Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagination links supplied by the remote registry in the HTTP Link header and attaches the registry credentials to the follow-up request without verifying that the pagination URL has...

CVE-2026-88887: URL Redirection to Untrusted Site

Renovate is a dependency update automation tool. When listing tags/digests for a container image, Renovate follows pagination links supplied by the remote registry in the HTTP Link header and attaches the registry credentials to the follow-up request without verifying that the pagination URL has...

CVE-2026-88880: URL Redirection to Untrusted Site

Renovate before 44.11.3 fails to validate Link header destinations when following GitLab server pagination, allowing malicious servers to redirect credential-bearing requests. Attackers controlling a compromised GitLab server can specify a Link header pointing to attacker-controlled infrastructur...

PT-2026-89391

Name of the Vulnerable Software and Affected Versions Renovate versions prior to 44.11.3 Description Renovate fails to validate destinations in the Link header when following GitLab server pagination. This allows a compromised GitLab server to specify a Link header pointing to attacker-controlled...

CVE-2026-88881: URL Redirection to Untrusted Site

Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP Link header when interacting with GitHub.com, GitHub Enterprise Cloud, or GitHub Enterprise Server, and sends the credentials configured for that host to the URL given as the 'next' page. Becaus...

PT-2026-89392

Renovate, a dependency update tool, follows pagination links supplied by the GitHub server in the HTTP Link header when interacting with GitHub.com, GitHub Enterprise Cloud, or GitHub Enterprise Server, and sends the credentials configured for that host to the URL given as the 'next' page. Becaus...

PT-2026-89562

Name of the Vulnerable Software and Affected Versions Amazon AWS Systems Manager Agent versions prior to 3.3.4851.0 Description A server-side request forgery SSRF issue exists in the port forwarding to remote hosts functionality. The software improperly validates equivalent address representation...

The vulnerability of the Microsoft Malware Protection Engine, a component of the Microsoft Defender antivirus protection tool, allows a malicious actor to gain unauthorized access to protected information.

The vulnerability of the Microsoft Malware Protection Engine, a component of the Microsoft Defender antivirus protection tool, relates to an improper definition of symbolic links before accessing a file. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protecte...

CVE-2026-19136: Improper Neutralization of Special Elements used in an OS Command

A potential command injection vulnerability was reported in the Tianxi AI Agent PC Application, distributed exclusively in the Chinese market, that could allow operating system commands to be executed if a local user opens a specially crafted link that is handled by the application...

CVE-2026-88264: Improper Link Resolution Before File Access

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations...

CVE-2026-88016: Improper Link Resolution Before File Access

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path...

CVE-2026-89049: Server-Side Request Forgery (SSRF)

A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Amazon AWS Systems Manager Agent SSM Agent before 3.3.4851.0 on all platforms might allow an authenticated remote user to bypass the remote...

CVE-2026-89049: Server-Side Request Forgery (SSRF)

A server-side request forgery issue due to improper validation of equivalent address representations in the port forwarding to remote hosts functionality in Amazon AWS Systems Manager Agent SSM Agent before 3.3.4851.0 on all platforms might allow an authenticated remote user to bypass the remote...

CVE-2026-88264: Improper Link Resolution Before File Access

A flaw was found in crun. When the container configuration does not give /dev a dedicated mount, terminal setup can redirect /dev/console onto an attacker-controlled path, including via the read-only-rootfs bind-mount fallback. Affected versions are crun 1.29.1 and earlier. Default configurations...

CVE-2026-88016: Improper Link Resolution Before File Access

rclone is a command-line program to sync files and directories to and from different cloud storage providers. Prior to 1.75.1, when backend/local runs with --links, a source .rclonelink object can plant a symlink in the destination and later directory metadata is applied through that path...

CVE-2026-88882: URL Redirection to Untrusted Site

Renovate is a dependency update automation tool. In versions before 44.11.2 and Mend Renovate CE/EE images and charts before 15.4.0, and mend-renovate-enterprise-edition helm chart before 10.4.0, when listing new package versions from a NuGet registry Renovate follows pagination URLs supplied by...