coderedcms (>=0.15.0, <=0.15.2), coop (2.5.0) +7 more potentially affected by CVE-2026-44200 via wagtail (2.5.2)

wagtail PYPI version 2.5.2 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - coderedcms =0.15.0, =0.0.3, =0.7.0rc2, =0.16.5, =0.20.1 - wagtail-textract 1.2.0.dev0 - wagtail-treemodeladmin 1.0.5 Source cves: CVE-2026-44200...

wagtail-metadata-mixin (0.0.7), wagtailperson (0.9.8) potentially affected by CVE-2026-44200 via wagtail (2.8.0)

wagtail PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-metadata-mixin 0.0.7 - wagtailperson 0.9.8 Source cves: CVE-2026-44200 Source advisory: OSV:GHSA-67RV-MG8Q-5PF3...

wagtail-metadata-mixin (0.0.7), wagtailperson (0.9.8) potentially affected by CVE-2026-44201 via wagtail (2.8.0)

wagtail PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-metadata-mixin 0.0.7 - wagtailperson 0.9.8 Source cves: CVE-2026-44201 Source advisory: OSV:GHSA-P5GM-92H4-6PV6...

wagtail-metadata-mixin (0.0.7), wagtailperson (0.9.8) potentially affected by CVE-2026-44199 via wagtail (2.8.0)

wagtail PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-metadata-mixin 0.0.7 - wagtailperson 0.9.8 Source cves: CVE-2026-44199 Source advisory: OSV:GHSA-PWM3-7FV4-G6XX...

wagtail-metadata-mixin (0.0.7), wagtailperson (0.9.8) potentially affected by CVE-2026-44198 via wagtail (2.8.0)

wagtail PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-metadata-mixin 0.0.7 - wagtailperson 0.9.8 Source cves: CVE-2026-44198 Source advisory: OSV:GHSA-C4MR-889M-VGF6...

wagtail-metadata-mixin (0.0.7), wagtailperson (0.9.8) potentially affected by CVE-2026-44197 via wagtail (2.8.0)

wagtail PYPI version 2.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on wagtail and may be impacted: - wagtail-metadata-mixin 0.0.7 - wagtailperson 0.9.8 Source cves: CVE-2026-44197 Source advisory: OSV:GHSA-C6WJ-9VCJ-75PJ...

Missing Authorization

Overview open-webui is an Open WebUI Affected versions of this package are vulnerable to Missing Authorization via the validatecollectionaccess function. An attacker can obtain sensitive metadata, such as IDs, names, and descriptions of all knowledge bases across users, by sending crafted API...

CVE-2026-42181 Lemmy: SSRF and internal image disclosure in post link metadata via unvalidated og:image

Lemmy is a link aggregator and forum for the fediverse. Prior to version 0.19.18, Lemmy fetches metadata for user-supplied post URLs and, under the default StoreLinkPreviews image mode, downloads the preview image through local pict-rs. While the top-level page URL is checked against internal IP...

CVE-2026-42181

Lemmy prior to 0.19.18 is vulnerable to SSRF through post link metadata: the system validates the top-level URL against internal ranges, but the og:image URL extracted from the page is not subjected to the same restriction. An authenticated low-privileged user can post a page whose og:image point...

GHSA-CMRH-WVQ6-WM9R n8n-mcp webhook and API client paths has an authenticated SSRF

Summary Authenticated Server-Side Request Forgery affecting the webhook trigger tools, the n8n API client N8NAPIURL, and per-request URLs supplied via the x-n8n-url header in multi-tenant HTTP mode. Impact A caller with access to the MCP session can drive HTTP requests from the n8n-mcp host to...

EUVD-2026-28631

In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: monaco: Reserve full Gunyah metadata region We observe spurious "Synchronous External Abort" exceptions ESR=0x96000010 and kernel crashes on Monaco-based platforms. These faults are caused by the kernel...

EUVD-2026-28579

In the Linux kernel, the following vulnerability has been resolved: md raid: fix hang when stopping arrays with metadata through dm-raid When using device-mapper's dm-raid target, stopping a RAID array can cause the system to hang under specific conditions. This occurs when: - A dm-raid managed...

CVE-2026-43420

In the Linux kernel, the following vulnerability has been resolved: ceph: fix inlink underrun during async unlink During async unlink, we drop the inlink counter before we receive the completion that will eventually update the inlink because "we assume that the unlink will succeed". That is not a...

UBUNTU-CVE-2026-43420

In the Linux kernel, the following vulnerability has been resolved: ceph: fix inlink underrun during async unlink During async unlink, we drop the inlink counter before we receive the completion that will eventually update the inlink because "we assume that the unlink will succeed". That is not a...

CVE-2026-43420

In the Linux kernel, the following vulnerability has been resolved: ceph: fix inlink underrun during async unlink During async unlink, we drop the inlink counter before we receive the completion that will eventually update the inlink because "we assume that the unlink will succeed". That is not a...

CVE-2026-43420 ceph: fix i_nlink underrun during async unlink

In the Linux kernel, the following vulnerability has been resolved: ceph: fix inlink underrun during async unlink During async unlink, we drop the inlink counter before we receive the completion that will eventually update the inlink because "we assume that the unlink will succeed". That is not a...

CVE-2026-43420

CVE-2026-43420 describes a race in Ceph/Linux kernel unlink handling where i_nlink is decremented before completion of async unlink, risking underrun if the updated i_nlink becomes zero. The root cause is updating i_nlink without proper synchronization between ceph_unlink() and MDS responses; the...

CVE-2026-43347

In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: monaco: Reserve full Gunyah metadata region We observe spurious "Synchronous External Abort" exceptions ESR=0x96000010 and kernel crashes on Monaco-based platforms. These faults are caused by the kernel...

CVE-2026-43347

In the Linux kernel, the following vulnerability has been resolved: arm64: dts: qcom: monaco: Reserve full Gunyah metadata region We observe spurious "Synchronous External Abort" exceptions ESR=0x96000010 and kernel crashes on Monaco-based platforms. These faults are caused by the kernel...

CVE-2026-43347

The CVE-2026-43347 details a Linux kernel arm64 Monaco issue where firmware mistakenly reports a Gunyah hypervisor memory region as available. The kernel may allocate from hypervisor-owned memory, causing spurious ESR=0x96000010 aborts and kernel crashes. The fix adds a reserved-memory carveout f...