CVE-2026-116197

Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over concrete domain matches. When a pull configuration lists both a concrete domain and its parent wildcard, registry credentials...

CVE-2026-116197

Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over concrete domain matches. When a pull configuration lists both a concrete domain and its parent wildcard, registry credentials...

EUVD-2026-109455

Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over concrete domain matches. When a pull configuration lists both a concrete domain and its parent wildcard, registry credentials...

PT-2026-123038

Edgeless Systems Contrast from 1.21.0 before 1.25.0 contains a non-deterministic registry selection flaw in imagepuller that can prefer wildcard configuration entries over concrete domain matches. When a pull configuration lists both a concrete domain and its parent wildcard, registry credentials...

Astra Linux – Vulnerability in openimageio

There is a heap-out-of-bounds read vulnerability in the RLA format parser of OpenImageIO master-branch-9aeece7a and v2.3.19.0. More specifically, it relates to the handling of run-length encoded byte spans. A malformed RLA file can lead to an out-of-bounds read of heap metadata, potentially...

DaKheera47 JobOps server-side request forgeing vulnerability

DaKheera47 JobOps 0.13.1 and earlier versions have a server-side request forgeing vulnerability. This vulnerability stems from the POST /api/manual-jobs/fetch handler, which allows for server-side request forgeing. Attackers can provide loopback, private, or cloud metadata addresses in the URL...

CVE-2026-104965

Plane is an open-source project management tool. Prior to 1.4.0, the issue-relation endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can create relations linking their own issues to issues in any other workspace ...

CVE-2026-104965 Plane: Cross-Tenant Issue Relation Creation via IDOR

Plane is an open-source project management tool. Prior to 1.4.0, the issue-relation endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can create relations linking their own issues to issues in any other workspace ...

CVE-2026-104965 Plane: Cross-Tenant Issue Relation Creation via IDOR

Plane is an open-source project management tool. Prior to 1.4.0, the issue-relation endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can create relations linking their own issues to issues in any other workspace ...

CVE-2026-104965

The project management tool Plane contains a cross-tenant issue relation creation vulnerability in versions prior to 1.4.0 . The issue-relation endpoint fails to validate that provided issue UUIDs belong to the caller's workspace, allowing an authenticated user to create relations linking their i...

CVE-2026-104965 Plane: Cross-Tenant Issue Relation Creation via IDOR

Plane is an open-source project management tool. Prior to 1.4.0, the issue-relation endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can create relations linking their own issues to issues in any other workspace ...

PT-2026-106033

Plane is an open-source project management tool. Prior to 1.4.0, the issue-relation endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can create relations linking their own issues to issues in any other workspace ...

CVE-2026-104965: Authorization Bypass Through User-Controlled Key

Plane is an open-source project management tool. Prior to 1.4.0, the issue-relation endpoint accepts issue UUIDs in the request body without validating that they belong to the caller's workspace. An authenticated user can create relations linking their own issues to issues in any other workspace ...

CVE-2026-100582

OpenClaw channel plugins @openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat before 2026.8.1 do not enforce the configured channel read allowlist for caller-supplied explicit read targets in message, reaction, pin, member, and related metadata read actions. A lower-tru...

EUVD-2026-87469

OpenClaw channel plugins @openclaw/msteams, @openclaw/feishu, @openclaw/matrix, and @openclaw/googlechat before 2026.8.1 do not enforce the configured channel read allowlist for caller-supplied explicit read targets in message, reaction, pin, member, and related metadata read actions. A lower-tru...

CVE-2026-100582

OpenClaw channel plugins (@openclaw/msteams , @openclaw/feishu , @openclaw/matrix , and @openclaw/googlechat ) versions prior to 2026.8.1 fail to enforce configured channel read allowlists for caller-supplied explicit read targets. This flaw affects actions involving messages, reactions, pins, me...

Malicious code in simple-date-formatter-new-11 (npm)

Source: amazon-inspector 10e00618100992f74fd0b4c908be0db1c3e13de1b37ae9dc5952b7836f564042 Package presents itself as a date-formatting utility but performs credential theft against the installer through two channels. The postinstall script in package.json curls cloud instance-metadata endpoints...

automation-controller: automation-controller-container: automation-controller: bulk job launch allows setting a workflow node's job reference to an arbitrary unified job, enabling a low-privileged user to cancel and read metadata of jobs in other organizations

A flaw was found in Red Hat Ansible Automation Platform's automation- controller. The bulk job launch endpoint builds workflow job nodes from client input using a serializer that leaves the node's job reference -- a field normally set by the workflow task manager after it spawns a child job --...

SUSE-SU-2026:23859-1 Security update for rabbitmq-server

This update for rabbitmq-server fixes the following issues: - CVE-2026-44839: XSS in management UI due to unsanitized vhost names bsc1266465. - CVE-2026-57212: The rabbitmqmanagement HTTP API accepts oversized valid JSON bodies on withdecode and directrequest paths bsc1271318. - CVE-2026-57213:...

CVE-2026-81178: Incorrect Authorization

SysReptor is a fully customizable pentest reporting platform. Prior to 2026.55, an unauthenticated holder of a public note share link receives project-wide collaborative editing metadata because the public share consumer joins the same collaboration group as authenticated project members and...