PT-2026-82702

Name of the Vulnerable Software and Affected Versions Spring Integration version 7.1.0 Spring Integration versions 7.0.0 through 7.0.5 Spring Integration versions 6.5.0 through 6.5.10 Spring Integration versions 6.4.0 through 6.4.12 Spring Integration versions 5.5.21 and earlier Description The...

CVE-2026-81688: Missing Encryption of Sensitive Data

opensslencrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. Attackers can read this hash without the password to confirm guessed plaintexts offline or fingerprint identical plaintexts across separately-encrypted files...

PT-2026-82588

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description The software fails to enforce a time ceiling on key derivation function KDF iteration counts specified in file metadata. A KDF is a cryptographic algorithm that derives one or more secret key...

PT-2026-82589

openssl encrypt versions before 1.4.9 store an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. Attackers can read this hash without the password to confirm guessed plaintexts offline or fingerprint identical plaintexts across separately-encrypted files...

CVE-2026-19889: Server-Side Request Forgery (SSRF)

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.9.0 to 19.0.12, 19.1 to 19.1.7, and 19.2 to 19.2.2 that could have allowed an authenticated user with Duo Agent Platform access to redirect model requests to an...

CVE-2026-59292: Incorrect Permission Assignment for Critical Resource

PropertiesPersistingMetadataStore, the default file-based ConcurrentMetadataStore, persists its state to $java.io.tmpdir/spring-integration/metadata-store.properties with world-readable permissions. Spring Integration 7.1.0 Spring Integration 7.0.0 - 7.0.5 Spring Integration 6.5.0 - 6.5.10 Spring...

CVE-2026-81703: Improper Authentication

opensslencrypt versions before 1.4.9 fail to validate encryption status of embedded post-quantum private keys in file metadata. Attackers can craft files with unencrypted embedded PQC keys that decrypt under any password, bypassing authentication and producing attacker-chosen plaintext with false...

PT-2026-82604

Name of the Vulnerable Software and Affected Versions openssl encrypt versions prior to 1.4.9 Description The software fails to validate the encryption status of embedded post-quantum cryptography PQC private keys within file metadata. This allows attackers to create files containing unencrypted...

PT-2026-82752

Name of the Vulnerable Software and Affected Versions gdk-pixbuf versions 2.26.4 and later Description A flaw exists when loading a specially crafted JPEG image containing chunked ICC profile markers. An error during the parsing of the ICC profile can leave stale size metadata after the profile...

PT-2026-82566

The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/get html skeleton.ts validated the url argument with isValidHttpUrl from src/utils/generic.ts, which confirmed the string began with an http or https scheme and parsed as a...

CVE-2026-75340

The device metadata import interface /device/instance/productId/property-metadata/import of jetlinks community 2.11 is vulnerable to Server-side request forgery SSRF...

CVE-2026-61792

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without adequately...

EUVD-2026-66720

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do not apply the permission checks used elsewhere, allowing unauthorized users to read change-history metadata from private projects and...

CVE-2026-61792 Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without adequately...

EUVD-2026-66716

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without adequately...

CVE-2026-61792

Weblate , a web-based continuous localization platform, is affected by a path traversal vulnerability in its App store metadata download feature (versions prior to 2026.7 ). Attacker-influenced paths are resolved without adequate confinement to the repository, allowing a user with project-adminis...

CVE-2026-61792 Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without adequately...

CVE-2026-61792 Weblate path traversal allows a project administrator to read arbitrary files via App store metadata download (Incomplete Fix of CVE-2026-34242)

Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.7, a project administrator can read files outside their repository through the App store metadata download feature, which resolves attacker-influenced paths without adequately...

CVE-2026-54256

Winter CMS (v1.2.12 and earlier) contains an Insecure Direct Object Reference (IDOR) in the backend FileUpload form widget. The widget's getFileRecord() resolved a user-supplied file_id POST parameter against the global system_files table without scoping to the widget's own relation or parent rec...

CVE-2026-54256 Winter: Authenticated IDOR in backend FileUpload widget allows cross-user access to attachment metadata

Winter CMS is a content management system built on the Laravel PHP framework. In versions up to and including 1.2.12, the backend FileUpload form widget trusted an attacker-controlled fileid POST parameter when resolving the attachment it operates on, allowing an authenticated backend user to rea...