PT-2026-89522

passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets...

CVE-2026-88893: Exposure of Sensitive Information to an Unauthorized Actor

OpenPanel share lookup procedures fail to validate access controls and return password hashes and protected report definitions to unauthenticated callers. Attackers with a share link can retrieve argon2id password hashes and full report configurations including event names, filters, and breakdown...

vim security update

9.1.083-9.0.1.el102.20 - Remove upstream references Orabug: 31197557 2:9.1.083-9.20 - RHEL-253668 CVE-2026-28420 buffer overflow in terminal emulator 2:9.1.083-9.19 - RHEL-215660 CVE-2026-55892 vim: stack out-of-bounds write in dumpprefixes 2:9.1.083-9.18 - RHEL-215683 CVE-2026-59857 vim: stack...

PT-2026-89354

An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db aggregation endpoint parses user-controlled aggregation JSON and passes it through a stage sanitizer that determines whether a nested arra...

CVE-2026-89043: Improper Verification of Cryptographic Signature

passport-saml-encrypted through 0.1.13 contains an XML signature wrapping vulnerability where signature verification and assertion extraction use independent XPath lookups with no cross-validation. Attackers holding any validly signed SAML message can prepend a forged unsigned assertion that gets...

PT-2026-89279

Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarker, and the localized lookup configuration setting is enabled it's by default enabled. This issue affects Apache FreeMarker from 2.2.0...

CVE-2026-84939: Relative Path Traversal

Path traversal vulnerability in Apache FreeMarker template loading mechanism, if the attacker can specify an arbitrary malformed locale identifier to FreeMarker, and the localized lookup configuration setting is enabled it's by default enabled. This issue affects Apache FreeMarker from 2.2.0...

CVE-2026-82060

In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed with the...

CVE-2026-82060 Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image Lookups

In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed with the...

CVE-2026-82060

CVE-2026-82060 is an insufficient validation flaw in MongoDB Server affecting sharded collections. During document insertion, shard key values were not properly validated, allowing authenticated users to store operator-shaped objects as shard key values. When change stream events for such documen...

Insufficient Validation of Shard Key Values in MongoDB Server Leads to Query Operator Injection in Change Stream Post-Image Lookups

In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed with the...

CVE-2026-73313

XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allows an authenticated attacker to complete login as another user by submitting their own registered passkey credential during the WebAuthn assertion step. The passkey verification...

CVE-2026-73313 XenForo < 2.3.13 MFA Bypass via Passkey TFA Provider

XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allows an authenticated attacker to complete login as another user by submitting their own registered passkey credential during the WebAuthn assertion step. The passkey verification...

CVE-2026-73313

XenForo versions before 2.3.13 contain an MFA bypass vulnerability in the passkey TFA provider . During the WebAuthn assertion step, the passkey verification path performs a global credential lookup without validating that the matched credential belongs to the user whose login is pending. This al...

CVE-2026-73313 XenForo < 2.3.13 MFA Bypass via Passkey TFA Provider

XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allows an authenticated attacker to complete login as another user by submitting their own registered passkey credential during the WebAuthn assertion step. The passkey verification...

PT-2026-87153

In MongoDB, insufficient validation of shard key values during document insertion allowed authenticated users to store documents with specially crafted, operator-shaped objects as shard key values in sharded collections. When change stream events for such documents were processed with the...

PT-2026-87058

XenForo before 2.3.13 contains a multi-factor authentication bypass vulnerability in the passkey TFA provider that allows an authenticated attacker to complete login as another user by submitting their own registered passkey credential during the WebAuthn assertion step. The passkey verification...

CVE-2026-86287

Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths. Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated. A single malformed mask will poison the lookup table. The result is that the lookup will silently succe...

CVE-2026-86287 Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths

Net::IP::LPM versions before 1.12 for Perl accept malformed prefix lengths. Non-numeric and non-ASCII prefix lengths are accepted and treated as 0. Integers over 31 bits are silently truncated. A single malformed mask will poison the lookup table. The result is that the lookup will silently succe...

CVE-2026-86287

The Net::IP::LPM module for Perl versions before 1.12 is vulnerable to improper input validation because it accepts malformed prefix lengths. Specifically, non-numeric and non-ASCII prefix lengths are treated as 0 , while integers exceeding 31 bits are silently truncated. A single malformed mask ...