PT-2026-66591

Name of the Vulnerable Software and Affected Versions Outstatic CMS versions prior to 2.2.0 Description The application contains a hardcoded JSON Web Token JWT signing secret. If the OST TOKEN SECRET environment variable is not configured, the system uses a default secret available in the public...

CVE-2026-52539

Outstatic CMS = 2.1.9 contains a hardcoded JWT signing secret. When the OSTTOKENSECRET environment variable is not set, the application falls back to the default value which is publicly visible in the source code repository. An unauthenticated remote attacker can exploit this by forging JWT sessi...

Security update for python313, python3 (important)

openSUSE security update: security update for python313, python3 ------------------------------------------------------------- Announcement ID: openSUSE-SU-2026:21459-1 Rating: important References: bsc1211301 bsc1258364 bsc1261969 bsc1261970 bsc1262098 bsc1262319 bsc1262654 bsc1263787...

EUVD-2026-51327

Outstatic CMS = 2.1.9 contains a hardcoded JWT signing secret. When the OSTTOKENSECRET environment variable is not set, the application falls back to the default value which is publicly visible in the source code repository. An unauthenticated remote attacker can exploit this by forging JWT sessi...

PT-2026-66413

The Spring Boot language server logs the raw value of the https proxy/HTTPS PROXY/http proxy/HTTP PROXY environment variable at INFO level whenever it creates an outbound HTTP client and no explicit http.proxy workspace setting is configured. Corporate proxy URLs frequently embed Basic-auth...

PT-2026-66589

Name of the Vulnerable Software and Affected Versions SourceCodester Tailor Management System version 1.0 Description An issue exists that allows SQL Injection, a technique where malicious SQL statements are inserted into entry fields for execution. This occurs at the 'customeredit.php' endpoint...

PT-2026-66560

Name of the Vulnerable Software and Affected Versions SGLang affected versions not specified Description An SSRF Server-Side Request Forgery and local file read issue exists in the multimodal generation endpoint '/v1/chat/completions'. This occurs because the image url variable is not properly...

PT-2026-66595

Name of the Vulnerable Software and Affected Versions AdonisJS HTTP Server versions 8.0.0-next.0 through 8.2.0 AdonisJS HTTP Server versions 9.0.0 through 9.0.2 Description The default HTML renderer interpolates the error.message variable directly into the HTML exception response without proper...

PT-2026-66542

Name of the Vulnerable Software and Affected Versions Banks versions prior to 2.4.3 Description Banks parses Tool JSON objects from the rendered body of % completion % blocks and resolves the import path field using importlib.import module... and getattr... to identify the callable for tool calls...

CVE-2026-52539

CVE-2026-52539 affects Outstatic CMS

CVE-2026-52539

Outstatic CMS = 2.1.9 contains a hardcoded JWT signing secret. When the OSTTOKENSECRET environment variable is not set, the application falls back to the default value which is publicly visible in the source code repository. An unauthenticated remote attacker can exploit this by forging JWT sessi...

PT-2026-66499

Name of the Vulnerable Software and Affected Versions OpenCost versions prior to 1.121.0 Description Authentication is not properly enforced for the 'GET /helmValues' endpoint, which exposes the base64-decoded HELM VALUES environment variable containing cloud provider credentials. Furthermore, th...

PT-2026-66465

CentreStack before 17.4 contains a session variable injection vulnerability that allows unauthenticated attackers to inject arbitrary session variables by embedding newline and tab characters into a crafted AccountName parameter posted to the SelectProvider.aspx endpoint. Attackers can exploit th...

CVE-2026-52539

Outstatic CMS = 2.1.9 contains a hardcoded JWT signing secret. When the OSTTOKENSECRET environment variable is not set, the application falls back to the default value which is publicly visible in the source code repository. An unauthenticated remote attacker can exploit this by forging JWT sessi...

PT-2026-66519

IBM Langflow OSS 1.0.0 through 1.10.1 are vulnerable to unauthenticated remote code execution via environment variable injection in the MCP Model Context Protocol stdio launcher. The vulnerability exists in src/lfx/src/lfx/base/mcp/util.py where the DANGEROUS ENV VARS blocklist fails to include...

PT-2026-66620

Name of the Vulnerable Software and Affected Versions RapidRAW versions prior to 1.6.0 Description Insufficient validation of the lutPath field in preset files before it is processed by the File::open function in lut processing.rs allows for a credential leak on Windows systems. An attacker can u...

PT-2026-66655

Impact In its default configuration, a Rails application that displays image variants may allow an unauthenticated attacker to read arbitrary files from the server, including the process environment. That environment typically holds secret key base and often credentials for external systems, whic...

CVE-2026-67427

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands $env.VAR for any host environment variable without an allowlist or capability policy check, allowing a workflow parameter to bypass the default capability polic...

CVE-2026-67427 Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands $env.VAR for any host environment variable without an allowlist or capability policy check, allowing a workflow parameter to bypass the default capability polic...

CVE-2026-67427

Flyto2 Core is an execution kernel for automation and AI-agent workflows. Prior to 2.26.6, the workflow engine variable resolver expands $env.VAR for any host environment variable without an allowlist or capability policy check, allowing a workflow parameter to bypass the default capability polic...