CVE-2026-72160

A flaw was found in ocfs2 Oracle Cluster File System version 2 in the Linux kernel. This vulnerability arises from insufficient validation of on-disk inode metadata, specifically the imode type bits. A local attacker could exploit this by crafting a malformed disk inode with a non-canonical POSIX...

[SECURITY] [DLA 4744-1] calibre security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-4744-1 [email protected] https://www.debian.org/lts/security/ Abhijith PA August 18, 2026 https://wiki.debian.org/LTS -...

PT-2026-80359

OpenList: Search metadata/count disclosure via Non-Separator-Aware Path Check in Bleve Search in github.com/OpenListTeam/OpenList...

PT-2026-77139

Name of the Vulnerable Software and Affected Versions RAGFlow versions prior to 0.26.3 Description A server-side request forgery SSRF issue exists in the agent workflow "Invoke" component located in agent/component/invoke.py. The component constructs outbound request URLs using canvas configurati...

PT-2026-76920

SiYuan before v3.7.4 contains a server-side request forgery SSRF vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode. The function only checks for loopback, link-local unicast, private, and unspecified addresses and does n...

CVE-2026-50167: Authorization Bypass Through User-Controlled Key

Kurrier is a modern, self-hosted workspace for email, calendar, contacts, and storage. Prior to 1.2.4, Kurrier API endpoints for listing and retrieving webhook and identity resources did not enforce ownership checks for authenticated API requests. An attacker with a valid API key could use anothe...

PT-2026-80463

uniget CLI: Metadata signature verification only runs when UNIGET IGNORE METADATA SIGNATURE is set in gitlab.com/uniget-org/cli...

PT-2026-80295

Summary Multiple GeoLens read/link endpoints authorized only the resource named in the request URL a map, a VRT, a source dataset, an AI request and failed to re-authorize a second, caller-influenced dataset that the request reached through a relationship, layer reference, mosaic source, or reque...

PT-2026-76944

ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection re-resolves the raw URL and follows redirects. Authenticated attackers can bypass the validat...

PT-2026-80423

Unsafe file permission restoration from metadata in github.com/rclone/rclone...

CVE-2026-75898: Server-Side Request Forgery (SSRF)

RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component agent/component/invoke.py. The component builds an outbound request URL from canvas configuration and runtime template variables and passes it to requests.get, requests.post, or...

VulnCheck KEV: CVE-2026-64849

MLflow contains a server-side request forgery vulnerability that can allow attackers to reach internal or cloud metadata services and receive responsestatus and responsebody...

PT-2026-77186

Vvveb is a powerful and easy to use CMS with page builder to build websites, blogs or ecommerce stores. Prior to 1.0.8.4, Vvveb backend digital asset operations allow a low-privileged Vendor to access digital assets linked to another Vendor's products. The admin/controller/product/digital-asset.p...

PT-2026-77306

FUXA is a web-based Process Visualization SCADA/HMI/Dashboard software. In 1.3.2 and earlier, the DEVICE BROWSE, DEVICE NODE ATTRIBUTE, HOST INTERFACES, and DEVICE TAGS REQUEST handlers in server/runtime/index.js return device-discovery, node-attribute, host-network-interface, and device-tag...

PT-2026-79918

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer role to modify certain package registry metadata without the required...

CVE-2026-74904: Missing Authorization

SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go including getRefText, checkBlockExist, and getBlockBreadcrumb. These handlers are gated only by basic authentication model.CheckAuth and lack publish-access filtering, allowing...

CVE-2026-70666: Server-Side Request Forgery (SSRF)

Lemur manages TLS certificate creation. Prior to 1.9.3, an authority-role member could update acmeurl through PUT /api/1/authorities/ without revalidation and direct setupacmeclientnoretry to an attacker-controlled ACME server. ACME directory and order responses contain newNonce, newOrder,...

CVE-2026-71303: Server-Side Request Forgery (SSRF)

Lemur manages TLS certificate creation. Prior to 1.9.3, validateacmeurl enforced ACMEDIRECTORYHOSTALLOWLIST when an authority was created, but PUT /api/1/authorities/ passed options to lemur/authorities/service.py without applying the same check. A user holding an authority role could replace the...

PT-2026-77281

Name of the Vulnerable Software and Affected Versions Lemur versions prior to 1.9.3 Description An issue exists where the validate acme url function fails to enforce the ACME DIRECTORY HOST ALLOWLIST when updating authority options via the 'PUT /api/1/authorities/' endpoint. A user with an...

Linux Distros Unpatched Vulnerability : CVE-2026-72160

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - ocfs2: reject dinodes with non-canonical imode type Patch series ocfs2: harden inode validators against forged metadata, v2. This series adds three structural...