CVE-2026-16213 Fantomas42 django-blog-zinnia Protected Entry Password entry_protection.py cleartext storage

A security flaw has been discovered in Fantomas42 django-blog-zinnia up to 0.20. Affected by this vulnerability is an unknown functionality of the file zinnia/views/mixins/entryprotection.py of the component Protected Entry Password Handler. The manipulation results in cleartext storage of...

CVE-2026-16213

A security flaw has been discovered in Fantomas42 django-blog-zinnia up to 0.20. Affected by this vulnerability is an unknown functionality of the file zinnia/views/mixins/entryprotection.py of the component Protected Entry Password Handler. The manipulation results in cleartext storage of...

CVE-2026-16213 Fantomas42 django-blog-zinnia Protected Entry Password entry_protection.py cleartext storage

A security flaw has been discovered in Fantomas42 django-blog-zinnia up to 0.20. Affected by this vulnerability is an unknown functionality of the file zinnia/views/mixins/entryprotection.py of the component Protected Entry Password Handler. The manipulation results in cleartext storage of...

OESA-2026-3032 cifs-utils security update

The in-kernel CIFS filesystem is generally the preferred method for mounting SMB/CIFS shares on Linux. Security Fixes: A flaw was found in the cifs-utils package where the cifs.upcall helper fails to securely drop its root privileges before looking up user information inside a user-controlled...

PT-2026-61319

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the ipv4 sysctl exit net function where net-ipv4.sysctl local reserved ports is freed prematurely. The memory should only be released after the unregister net sysctl...

PT-2026-61407

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the batman-adv module where the system could send empty VLAN responses when replying from the global TT state. This occurs because previous checks were only applied to...

PT-2026-61060

A Missing Authorization vulnerability in selinux policycoreutils seunshares allows a user that is running in unconfined context to kill e.g. root-owned processes running also in unconfined context This issue affects policycoreutils through 3.10...

PT-2026-61047

A security flaw has been discovered in Fantomas42 django-blog-zinnia up to 0.20. Affected by this vulnerability is an unknown functionality of the file zinnia/views/mixins/entry protection.py of the component Protected Entry Password Handler. The manipulation results in cleartext storage of...

PT-2026-61467

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description An issue exists in the netfilter module, specifically within the nft inner component. In the error path, the local bh enable function is called before local unlock nested bh, which resul...

CVE-2026-16130

A vulnerability was identified in nearai ironclaw up to 0.29.1. The affected element is the function validatepath of the file src/tools/builtin/pathutils.rs of the component writefile. The manipulation leads to link following. Local access is required to approach this attack. The exploit is...

CVE-2026-16129

A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the function ShellAction.validatecommand of the file src/safestclaw/actions/shell.py of the component Built-in Web Interface. Such manipulation leads to incomplete blacklist. An attack has to be...

CVE-2026-16130 nearai ironclaw write_file path_utils.rs validate_path link following

A vulnerability was identified in nearai ironclaw up to 0.29.1. The affected element is the function validatepath of the file src/tools/builtin/pathutils.rs of the component writefile. The manipulation leads to link following. Local access is required to approach this attack. The exploit is...

EUVD-2026-45391

A vulnerability was identified in nearai ironclaw up to 0.29.1. The affected element is the function validatepath of the file src/tools/builtin/pathutils.rs of the component writefile. The manipulation leads to link following. Local access is required to approach this attack. The exploit is...

CVE-2026-16130 nearai ironclaw write_file path_utils.rs validate_path link following

A vulnerability was identified in nearai ironclaw up to 0.29.1. The affected element is the function validatepath of the file src/tools/builtin/pathutils.rs of the component writefile. The manipulation leads to link following. Local access is required to approach this attack. The exploit is...

CVE-2026-16129

The CVE-2026-16129 entry concerns princezuda SafestClaw (Built-in Web Interface) with a flaw in ShellAction._validate_command in src/safestclaw/actions/shell.py of the Built-in Web Interface. The vulnerability is described as an incomplete blacklist in the command validation logic, enabling local...

EUVD-2026-45390

A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the function ShellAction.validatecommand of the file src/safestclaw/actions/shell.py of the component Built-in Web Interface. Such manipulation leads to incomplete blacklist. An attack has to be...

CVE-2026-16129 princezuda SafestClaw Built-in Web shell.py ShellAction._validate_command incomplete blacklist

A vulnerability has been found in princezuda SafestClaw up to 4.2.4. This vulnerability affects the function ShellAction.validatecommand of the file src/safestclaw/actions/shell.py of the component Built-in Web Interface. Such manipulation leads to incomplete blacklist. An attack has to be...

CVE-2026-9323

The urwid web display backend urwid/display/web.py generates web session identifiers urwidid in Screen.start by concatenating two random.randrange109 calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of PRNG state, and t...

EUVD-2026-45381

The urwid web display backend urwid/display/web.py generates web session identifiers urwidid in Screen.start by concatenating two random.randrange109 calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of PRNG state, and t...

CVE-2026-9323 Insecure PRNG and Information Exposure in urwid Web Display Backend

The urwid web display backend urwid/display/web.py generates web session identifiers urwidid in Screen.start by concatenating two random.randrange109 calls that use Python's Mersenne Twister PRNG, which is not cryptographically secure. Each call consumes approximately 30 bits of PRNG state, and t...